Remote Senior AppSec Engineer - Build Secure Cloud Apps

Turquoise; United States; Remote; USD 150,000 - 210,000; Full time

Benefits offered by this job

Competitive pay with equity options

Fully remote work + flexible working

Stellar health care plan options (Med,

401(k) + 4% Matching

Unlimited PTO

Biannual in-person summits

Job summary

Turquoise Health is a remote-first, US-based company seeking a Senior Application Security Engineer to own application-layer security across our platform and drive our code scanning program. You will work closely with engineering on design, architecture, and secure development practices.

The role emphasizes threat modeling, incident response support, and collaboration to embed security early in SDLC and CI/CD pipelines.

Qualifications

• 5+ years of experience in application security, security engineering, or a related software role.
• Hands-on with SAST, DAST, and dependency/SCA scanning tools; able to distinguish real risk from noise.
• Deep understanding of OWASP Top 10 and common vulnerability classes; able to review code and architecture.
• Experience securing cloud environments (AWS preferred) and modern CI/CD pipelines.
• Strong communication skills to explain risk to engineers and non-security stakeholders.
• Collaborative, pragmatic security approach that balances risk reduction with speed.

Responsibilities

• Build and run our application security scanning program (SAST, DAST, SCA, container and IaC scanning) and tune tools.
• Triage findings from scans, pen tests, and bug bounty; prioritize by risk and track remediation.
• Partner with engineering teams to fix vulnerabilities with hands-on debugging and code guidance.
• Promote security in early design through mature SDLC and CI/CD pipelines.
• Perform threat modeling and maintain secure-coding standards.
• Support incident response for application-layer security issues.
• Coordinate and help manage third-party penetration tests.
• Track and report security posture metrics to engineering and leadership.

Skills

5+ yrs exp

SAST

DAST

SCA

AWS

CI/CD

Communication

Collaboration

Tools

Python

Go

Terraform

Code scanning tools

Job description

Turquoise Health is a remote-first, US-based company seeking a Senior Application Security Engineer to own application-layer security across our platform and drive our code scanning program. You will work closely with engineering on design, architecture, and secure development practices.

The role emphasizes threat modeling, incident response support, and collaboration to embed security early in SDLC and CI/CD pipelines.