Remote Application Security Engineer - Secure by Default

OpenKrill; United States; Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Medical, dental, vision benefits

Flexible remote work

Career growth opportunities

Job summary

Quartermaster AI is seeking a Security Engineer, Application Security to own the security of cloud services, APIs, data pipelines, and edge deployments. You will lead threat modeling, perform secure code reviews, and steer secure-by-default architecture across our distributed systems.

You will integrate SAST/DAST/SCA into CI/CD, drive remediation with engineering teams, and develop paved-road security tooling to make secure development the norm.

Qualifications

• 5–8 years in application security, product security, or software engineering with a security focus.
• Proficient in one or more modern languages (Python, Go, Java, JavaScript/TypeScript, Rust, or C/C++) and able to read production code.
• Experience leading threat modeling and security design reviews.
• Hands-on with SAST/DAST/SCA and integrating them into CI/CD pipelines.
• Knowledge of OWASP Top 10, CWE, and secure coding practices.
• Experience securing microservices, REST/gRPC, containers, and cloud environments (AWS/Azure/GCP).
• Experience black-box/grey-box testing of web apps and APIs.
• Proven track record driving remediation with engineering teams.
• Excellent written and verbal communication; ability to explain risk.
• Must be a U.S. citizen.
• Bachelor’s degree in CS/Cybersecurity or equivalent hands-on experience.

Responsibilities

• Lead threat modeling and secure design reviews for new and existing services, identifying and mitigating risk early in the development lifecycle.
• Perform in-depth secure code reviews and full-scope application security assessments across web, API, cloud, and backend services.
• Build, integrate, and tune application security tooling in CI/CD — SAST, DAST, SCA, secret scanning, and static analysis platforms such as CodeQL.
• Triage, prioritize, and drive remediation of application vulnerabilities with engineering teams, ranking by risk and business impact.
• Develop automation and paved-road tooling to reduce weaknesses and make secure paths the default for developers.
• Serve as the application security SME for engineers and architects, steering secure-by-default patterns.
• Define and mature the secure software development lifecycle (SDLC) and security standards.
• Own or support vulnerability disclosure and bug bounty processes, including root-cause analysis and coordinating fixes.
• Strengthen software supply chain security, including dependency management and build/pipeline integrity.
• Partner with security operations on application-layer incidents and code-level remediation.
• Deliver developer-focused security training and promote a security-aware engineering culture.

Skills

Threat modeling

Secure design reviews

Secure coding practices

CI/CD security tooling

Vulnerability remediation coordination

Security training

Communication

Reading production code

Education

Bachelor’s degree in CS/Cybersecurity

Tools

CodeQL

SAST tooling

DAST tooling

SCA tooling

CI/CD pipelines

Job description

Quartermaster AI is seeking a Security Engineer, Application Security to own the security of cloud services, APIs, data pipelines, and edge deployments. You will lead threat modeling, perform secure code reviews, and steer secure-by-default architecture across our distributed systems.

You will integrate SAST/DAST/SCA into CI/CD, drive remediation with engineering teams, and develop paved-road security tooling to make secure development the norm.