Remote Applications Security Engineer: Secure Code & Cloud

Ladder; Connecticut; Remote; USD 109,000 - 130,000; Full time

Benefits offered by this job

Medical, dental, vision

Flexible PTO

Stock options

401k match

Wellness stipend

WFH stipend

Remote work

Job summary

Ladder is seeking an Applications Security Engineer to drive vulnerability management across our development lifecycle. This remote role supports our cloud and on-prem infrastructure, primarily in a JVM/Clojure ecosystem, with a focus on secure-by-design practices.

You will work with engineering teams to implement secure coding, monitor security posture, and perform risk assessments across APIs and third-party integrations.

Qualifications

• 4+ years of software engineering or cybersecurity experience.
• Hands-on in the JVM environment; able to read functional code.
• Experience securing modern cloud infrastructures and incident response.
• Baseline security certifications; CISSP is highly preferred.

Responsibilities

• Lead application security vulnerability management with development teams.
• Monitor cloud security posture using SIEM, SOAR, CNAPP.
• Conduct security reviews and risk assessments of internal architecture, vendors and APIs.
• Maintain workspace security including IAM and device compliance.
• Mentor engineers on secure coding practices and secure defaults.

Skills

Software engineering

Cybersecurity fundamentals

JVM experience

Cloud security

Incident response

Security+

CISSP (preferred)

Education

CompTIA Security+ or equivalent

CISSP (preferred)

Tools

Datomic

GCP

Kubernetes

Terraform

GraphQL

Google Security Command Center

Job description

Ladder is seeking an Applications Security Engineer to drive vulnerability management across our development lifecycle. This remote role supports our cloud and on-prem infrastructure, primarily in a JVM/Clojure ecosystem, with a focus on secure-by-design practices.

You will work with engineering teams to implement secure coding, monitor security posture, and perform risk assessments across APIs and third-party integrations.