Remote Application Security Engineer: Source Code Review

Invadel; United States; Remote; USD 90,000 - 130,000; Full time

Job summary

Invadel is seeking an experienced security reviewer to assess web, mobile, and backend code by combining static analysis with hands-on investigation. You will examine repository scopes, explain actionable risks to engineers, and verify that reported issues are fixed.

The role involves triaging analysis results, reviewing authentication and cryptography, tracing data flows, and documenting findings with precise evidence. This is a remote US-based position with US time-zone alignment.

Qualifications

• Four+ years combined software engineering and application security experience.
• Ability to read code in JS/TS, Python, Java/Kotlin, C#, Go, PHP, Ruby or Swift.
• Based in the United States and authorized to work there; client work follows US time zones.
• Strong reporting skills; a redacted sample report is required with the application.
• Able to work within a written scope and provide two professional references familiar with live engagements.

Responsibilities

• Triage static analysis results and remove false positives before reporting.
• Review authentication, authorization, input handling, cryptography, secrets management, and third‑party dependencies.
• Trace data flows across services to uncover cross‑component flaws.
• Document findings with file/line references, safe exploitability evidence, and remediation examples.
• Retest fixes and update reports.

Skills

Software engineering

Application security

Code review

Reporting

Job description

Invadel is seeking an experienced security reviewer to assess web, mobile, and backend code by combining static analysis with hands-on investigation. You will examine repository scopes, explain actionable risks to engineers, and verify that reported issues are fixed.

The role involves triaging analysis results, reviewing authentication and cryptography, tracing data flows, and documenting findings with precise evidence. This is a remote US-based position with US time-zone alignment.