Remote Senior AppSec Engineer — Automate & Secure

Sardine; United States; Remote; USD 140,000 - 210,000; Full time

Benefits offered by this job

Generous cash and equity compensation

Remote-first culture

Flexible PTO

Job summary

Sardine is seeking an experienced Application Security Engineer to own and automate vulnerability management across multi-cloud services. You will triage, route, and close findings from SAST/DAST/SCA, write static analysis rules, and reduce root causes with secure defaults.

The role emphasizes collaboration across teams and hands-on testing of APIs and services. You will drive threat modeling, enable security champions, and collaboratively improve platform security in a remote-first, US-based

Qualifications

• Experience running vulnerability management end to end.
• Engineering background with shipped software.
• Ownership to complete fixes across teams.
• Judgment over tenure; depth of technical judgment.
• Proficient in Go, Python, Node.js, Ruby, or Java.
• Strong OWASP Top 10 focus on access control and business logic.
• Familiar with SAST, DAST, SCA in CI/CD.
• Cloud fundamentals on AWS or GCP.
• Ability to separate real findings from theory.

Responsibilities

• Triage, validate, route, and drive remediation of findings from all sources (SAST, DAST, SCA, code review, pentests, bug bounty).
• Build automation to remove manual effort from those steps.
• Direct external pentests and bug bounty scope, severity, and closure.
• Spot patterns across findings and remove root causes, not just fixes.
• Set secure defaults and patterns to make the right path easy for engineers.
• Write custom static analysis rules (Semgrep, CodeQL) to fix classes long-term.
• Review platform controls (authorization, secrets handling) and push for fixes.
• Collaborate with engineers on fixes that are simple, adopted, and lasting.
• Hands-on testing of apps and APIs, with depth in authorization and business logic.
• Threat modeling on new/high-exposure designs; security enablement across engineering.

Skills

Vulnerability management

Security automation

Go/Python/JS/Java

Threat modeling

OWASP Top 10

CI/CD security tooling

Docker and Kubernetes

Code auditing

Asynchronous collaboration

Ownership to done

Tools

Semgrep

CodeQL

Jenkins

GitHub Actions

Job description

Sardine is seeking an experienced Application Security Engineer to own and automate vulnerability management across multi-cloud services. You will triage, route, and close findings from SAST/DAST/SCA, write static analysis rules, and reduce root causes with secure defaults.

The role emphasizes collaboration across teams and hands-on testing of APIs and services. You will drive threat modeling, enable security champions, and collaboratively improve platform security in a remote-first, US-based