Security engineer

Air Apps; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Remote-first approach

Apple hardware ecosystem

Flexible PTO

Annual Bonus

Health Insurance

Public Transportation Pass

Coverflex benefits package

Air Conference 2025 in Las Vegas

Job summary

Air Apps is seeking an experienced security engineer to advance our AI-powered Personal & Entrepreneurial Resource Planner. You will model threats, conduct scans and pentests, and define secure coding practices across teams. Collaborate with DevOps to embed security in CI/CD, monitor incidents, and ensure ISO 27001/GDPR/SOC 2 compliance.

Remote-first with annual bonus and comprehensive Health Insurance. Experience in cloud security (AWS/Azure/GCP), IAM, encryption, and incident response is

Qualifications

• 4+ years in cybersecurity, application security, or security engineering.
• Knowledge of OWASP Top 10 and threat modeling techniques.
• Experience with vulnerability scanning tools and penetration testing methodologies.
• Ability to work with DevSecOps and integrate security into CI/CD pipelines.

Responsibilities

• Develop and implement threat modeling across applications and infrastructure.
• Conduct vulnerability scanning, pentesting, and security assessments.
• Define and enforce secure coding practices with development teams.
• Integrate security testing into CI/CD with DevOps collaboration.
• Monitor security incidents, perform root-cause analysis, and implement fixes.
• Ensure compliance with ISO 27001, GDPR, SOC 2 and related standards.
• Design IAM policies, encryption standards, and authentication mechanisms.
• Collaborate with product teams for security reviews of features and APIs.
• Create incident response plans and security documentation.
• Stay ahead of emerging threats and security technologies.

Skills

Threat modeling

Secure coding principles

Vulnerability assessment

Penetration testing

Security monitoring

Scripting/Automation (Python,Bash,PS)

Cloud security (AWS/Azure/GCP)

IAM & encryption knowledge

DevSecOps

Incident response planning

Tools

Nessus

Qualys

Burp Suite

SIEM

IDS

Job description

Описание: At Air Apps, we believe in thinking bigger- and moving faster. We’re a family-founded company on a mission to create the world’s first AI-powered Personal & Entrepreneurial Resource Planner (PRP), and we need your passion and ambition to help us change how people plan, work, and live. Born in Lisbon, Portugal in 2018- and now with offices in both Lisbon and San Francisco,we’ve remained self-funded while reaching over 100 million downloads worldwide.

Задачи:

• Develop and implement threat modeling to identify security risks across applications and infrastructure.
• Conduct vulnerability scanning, penetration testing, and security assessments to detect weaknesses.
• Define and enforce secure coding practices in collaboration with development teams.
• Work with DevOps to integrate security into CI/CD pipelines and automate security testing.
• Monitor and respond to security incidents, conducting root cause analysis and implementing preventative measures.
• Ensure compliance with security standards and regulations (e.g., ISO 27001, GDPR, SOC 2).
• Design and implement identity and access management (IAM) policies, encryption standards, and authentication mechanisms.
• Collaborate with product teams to conduct security reviews of features, APIs, and third-party integrations.
• Develop incident response plans, security documentation, and best practices.
• Stay ahead of emerging threats, vulnerabilities, and security technologies.

Требования:

• Around 4+ years of experience in cybersecurity, application security, or security engineering.
• Strong knowledge of secure coding principles, OWASP Top 10, and threat modeling techniques.
• Experience with vulnerability scanning tools (Nessus, Qualys, Burp Suite) and penetration testing methodologies.
• Hands-on experience with SIEM, intrusion detection systems (IDS), and security monitoring tools.
• Proficiency in scripting and automation (Python, Bash, PowerShell) for security tasks.
• Familiarity with cloud security in AWS, Azure, or GCP, including IAM and workload protection.
• Knowledge of encryption protocols, network security, and API security best practices.
• Experience working with DevSecOps, integrating security into CI/CD pipelines.
• Ability to analyze security logs, detect anomalies, and mitigate potential threats.
• Excellent problem-solving skills and ability to communicate security concepts to non-technical stakeholders.

Условия:

• Remote-first approach with flexible working hours.
• Apple hardware ecosystem for work.
• Flexible Paid Time Off (PTO) to support work-life balance.
• Annual Bonus.
• Top-tier Health Insurance for peace of mind.
• Public Transportation Pass to support your commute needs.
• Coverflex benefits package for meal allowances, well-being, and more.
• Air Conference 2025 in Las Vegas - an opportunity to meet the team, collaborate, and grow together.