Remote AppSec Architect & Vulnerability Lead

Mitek Systems; San Diego (CA); On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

Stock plan participation

Home office allowance

Wellness benefits

Paid time off

Learning & development

Job summary

Mitek Systems in San Diego seeks an experienced AppSec Engineer to bridge security and engineering, owning remediation for a 50-person development team building internet‑banking software. You will embed security into the SDLC, drive prioritized remediation, and lead security across APIs and architecture.

Expect deep expertise in threat modeling, SAST/DAST/SCA tuning, secure code review, and OWASP Top 10/API risk management.

Qualifications

• 5–8 years in application/product security or security-focused software engineering.
• Application penetration testing including business-logic and API testing.
• Hands-on SAST, DAST, and SCA tuning and operationalization.
• Secure code review across at least two web-application languages.
• Threat modeling using STRIDE, PASTA, or equivalent.
• Depth in OWASP Top 10 and API security risks; ability to influence development teams.

Responsibilities

• Vulnerability remediation program ownership with prioritized developer guidance and clear SLAs.
• Secure Development Lifecycle: define and own the SDLC — security gates and review checkpoints in sprint and release processes.
• Threat modeling & secure design: model new features before code is written and review designs for risk.
• API security & secure code review: own API security standards and coordinate manual review of security-sensitive components.
• Developer enablement: run Security Champions program and deliver developer security training.

Skills

AppSec

Penetration testing

SAST/DAST/SCA

Secure code review

Threat modeling

OWASP Top10/API

Job description

Mitek Systems in San Diego seeks an experienced AppSec Engineer to bridge security and engineering, owning remediation for a 50-person development team building internet‑banking software. You will embed security into the SDLC, drive prioritized remediation, and lead security across APIs and architecture.

Expect deep expertise in threat modeling, SAST/DAST/SCA tuning, secure code review, and OWASP Top 10/API risk management.