Remote Senior Product Security Engineer – AppSec Lead

Distribusion; United States; Remote; USD 150,000 - 190,000; Full time

Benefits offered by this job

Remote-first

International opportunities

Competitive salary

Job summary

Distribusion is building the AppSec program from the ground up. We seek a Senior Product/Application Security Engineer to own secure development, define review scope, and implement gates across a large engineering org.

You will work with Python/Go/TypeScript and cloud security in a remote-first, global team. You will lead threat modeling, triage vulnerability findings, and coordinate annual external tests to ensure PCI-DSS and ISO 27001 readiness.

Qualifications

• 5+ years in Product/Application Security or 3+ years with strong software engineering/web-pentesting background.
• Ability to read and write production code (Python, Go, TypeScript, Ruby, etc.).
• Deep knowledge of web and API security (OAuth2, JWT, rate limiting, tenant isolation, IDOR, XSS).
• Strong cloud security fundamentals (GCP preferred).
• Experience with threat modelling and secure design reviews on real systems (STRIDE or similar).
• Hands-on with SAST/SCA/secrets scanning in CI.

Responsibilities

• Lead threat modeling and secure design reviews for high-risk changes, partner integrations, and payment flows.
• Implement, tune, and enforce security gates in GitLab CI/CD with minimal friction for developers.
• Act as the primary technical owner for triaging and prioritizing bug bounty findings, pentests, and scanners.
• Collaborate with DevOps to implement GCP policies, IAM least-privilege, and Cloud Armor.
• Establish security champions network and leverage automation/AI-assisted tooling to scale code reviews.
• Own end-to-end vulnerability management with risk-ranked backlog, SLAs, and escalation paths.

Tools

GitLab CI/CD

Aikido

Semgrep

Snyk

Job description

Distribusion is building the AppSec program from the ground up. We seek a Senior Product/Application Security Engineer to own secure development, define review scope, and implement gates across a large engineering org.

You will work with Python/Go/TypeScript and cloud security in a remote-first, global team. You will lead threat modeling, triage vulnerability findings, and coordinate annual external tests to ensure PCI-DSS and ISO 27001 readiness.