Remote App Security Engineer — CI/CD & Vulnerability Mgmt

Arcadia Power, Inc.; Washington, Northern (District of Columbia, KY); Hybrid; USD 131,000 - 235,000; Full time

Benefits offered by this job

Remote-first culture

Flexible PTO

11 holidays

10 sick days

Bereavement leave

2 PD days

Parental Leave

Premium benefits

Job summary

Arcadia Power, Inc. is seeking a hands-on Application Security Engineer to own the vulnerability management lifecycle across SAST, DAST, and SCA tooling, and to automate security tasks in the CI/CD pipeline.

You will drive threat modeling with product and engineering, serve as the security SME during incidents, and help embed security across teams in a remote-first, US-wide environment. A SaaS security background and strong communication skills are highly valued.

Qualifications

• 3–5 years of dedicated Application Security experience in SaaS or cloud-native environments.
• Hands-on with two or more of SAST, DAST, SCA, or CSPM tooling.
• Strong knowledge of CI/CD pipelines and ability to wire integrations.
• Experience securing containers (Docker, Kubernetes) and API security patterns.

Responsibilities

• Own end-to-end vulnerability management lifecycle across SAST, DAST, and SCA tooling.
• Automate security tooling integrations within the CI/CD pipeline to reduce manual work.
• Launch and run a Security Champions program across geographies.
• Act as application-layer security SME during incidents, supporting triage and root cause analysis.
• Collaborate with Product and Engineering leadership to embed security earlier in SDLC.

Skills

SAST

DAST

SCA

CSPM tooling

CI/CD pipelines

Docker

Kubernetes

API security (REST/GraphQL)

Security risk communication

Threat modeling

Tools

GitHub Actions

Jenkins

GitLab CI

Snyk

Checkmarx

Semgrep

Wiz

Cloud security tooling

Job description

Arcadia Power, Inc. is seeking a hands-on Application Security Engineer to own the vulnerability management lifecycle across SAST, DAST, and SCA tooling, and to automate security tasks in the CI/CD pipeline.

You will drive threat modeling with product and engineering, serve as the security SME during incidents, and help embed security across teams in a remote-first, US-wide environment. A SaaS security background and strong communication skills are highly valued.