Remote Application Security Engineer — Secure SDLC Leader

Quartermaster; United States; Remote; USD 140,000 - 210,000; Full time

Benefits offered by this job

Competitive salary

Medical, dental, and vision benefits

Flexible remote work

Career growth

Job summary

Quartermaster AI is seeking an experienced Security Engineer, Application Security, to own the security of our software stack—from cloud services to edge-deployed systems. You will lead threat models, design reviews, and drive secure-by-default practices across the engineering org.

You’ll build tooling, automate security checks in CI/CD, and partner with engineering, security operations, and GRC to raise the security bar while enabling developers to move fast.

Qualifications

• 5–8 years in application security, product security, or software engineering with a strong security focus.
• Experience reading and reasoning about production code in modern languages.
• Hands-on with application security tooling and CI/CD integration.
• Familiarity with OWASP Top 10, CWE and secure coding practices.
• Experience securing microservices, REST/gRPC, containers and cloud environments.

Responsibilities

• Lead threat modeling and secure design reviews for new and existing services.
• Conduct in-depth secure code reviews and security assessments (whitebox, greybox, blackbox).
• Build and tune app security tooling in CI/CD (SAST, DAST, SCA, secret scanning, CodeQL).
• Triage and remediate vulnerabilities with engineering teams by real-world risk.
• Develop automation to make secure-by-default the standard path for developers.

Skills

Application security experience

Secure coding

OWASP Top 10 knowledge

Cloud security

CI/CD tooling integration

Education

Bachelor's degree in CS or Cybersecurity

Tools

CodeQL

SAST/DAST tools

CI/CD tooling

Job description

Quartermaster AI is seeking an experienced Security Engineer, Application Security, to own the security of our software stack—from cloud services to edge-deployed systems. You will lead threat models, design reviews, and drive secure-by-default practices across the engineering org.

You’ll build tooling, automate security checks in CI/CD, and partner with engineering, security operations, and GRC to raise the security bar while enabling developers to move fast.