Security Engineer

Stravexa Private Limited; United States; On-site; USD 140,000 - 210,000; Full time

Job summary

Stravexa Private Limited is seeking a Senior Security Engineer to bridge automated security scanning with product engineering teams. You will lead threat modeling, vulnerability triage, exploitability validation, and automated patch QA to drive security issues through production closure.

The role requires hands-on security engineering, strong programming in C++, Go, Java, or Python, and deep knowledge of CWE/CVE, OWASP Top 10, and secure coding practices.

Qualifications

• Strong hands-on experience in Application/Product Security Engineering.
• Experience with Threat Modeling, including trust boundaries, attack surfaces, data flows, STRIDE/PASTA.
• Strong knowledge of CWE, CVE, OWASP Top 10, vulnerability severity, and remediation SLAs.
• Ability to reproduce vulnerabilities, build PoCs, and create test harnesses.
• Strong programming skills in at least 2 of: C++, Go, Java, Python.
• Strong debugging and source-code review experience.
• Knowledge of secure coding practices, input validation, boundary checking, and safe memory access.
• Experience validating automated/AI-generated security patches, including code-diff review and regression testing.
• Ability to work directly with product engineering teams and drive vulnerabilities through verified resolution.

Responsibilities

• Bridge automated security scanning/remediation with product engineering teams.
• Perform threat modeling, vulnerability triage, and exploitability validation.
• Lead automated patch QA and drive security issues through production closure.
• Reproduce vulnerabilities, build PoCs, and review code diffs for patches.

Skills

Threat modeling

Vulnerability triage

Exploitability validation

Automated patch QA

Secure coding practices

C++

Go

Java

Python

Code review

Job description

Duration: 12+ Months Contract with Possible Extension

We are looking for Senior Security Engineers to support a security engineering project focused on bridging automated security scanning/remediation systems with product engineering teams. The team will be responsible for threat modeling, vulnerability triage, exploitability validation, automated patch QA, and driving security issues through production closure.

Required Skills

• Strong hands-on experience in Application/Product Security Engineering.
• Experience with Threat Modeling, including trust boundaries, attack surfaces, data flows, STRIDE/PASTA.
• Strong knowledge of CWE, CVE, OWASP Top 10, vulnerability severity, and remediation SLAs.
• Ability to reproduce vulnerabilities, build PoCs, and create test harnesses.
• Strong programming skills in at least 2 of: C++, Go, Java, Python.
• Strong debugging and source-code review experience.
• Knowledge of secure coding practices, input validation, boundary checking, and safe memory access.
• Experience validating automated/AI-generated security patches, including code-diff review and regression testing.
• Ability to work directly with product engineering teams and drive vulnerabilities through verified resolution.

Nice to Have

• SAST/DAST and automated security scanning experience.
• Fuzz testing and differential testing.
• Experience with distributed/microservice architectures.
• Experience with AI/agentic code-generation or automated remediation tools.
• Prompt tuning/debugging of automated coding agents.