Security Engineer, Application Security

OpenKrill; United States; À distance; USD 140 000 - 190 000; Plein temps

Avantages offerts par ce poste

Medical, dental, vision benefits

Flexible remote work

Career growth opportunities

Résumé du poste

Quartermaster AI is seeking a Security Engineer, Application Security to own the security of cloud services, APIs, data pipelines, and edge deployments. You will lead threat modeling, perform secure code reviews, and steer secure-by-default architecture across our distributed systems.

You will integrate SAST/DAST/SCA into CI/CD, drive remediation with engineering teams, and develop paved-road security tooling to make secure development the norm.

Qualifications

• 5–8 years in application security, product security, or software engineering with a security focus.
• Proficient in one or more modern languages (Python, Go, Java, JavaScript/TypeScript, Rust, or C/C++) and able to read production code.
• Experience leading threat modeling and security design reviews.
• Hands-on with SAST/DAST/SCA and integrating them into CI/CD pipelines.
• Knowledge of OWASP Top 10, CWE, and secure coding practices.
• Experience securing microservices, REST/gRPC, containers, and cloud environments (AWS/Azure/GCP).
• Experience black-box/grey-box testing of web apps and APIs.
• Proven track record driving remediation with engineering teams.
• Excellent written and verbal communication; ability to explain risk.
• Must be a U.S. citizen.
• Bachelor’s degree in CS/Cybersecurity or equivalent hands-on experience.

Responsabilités

• Lead threat modeling and secure design reviews for new and existing services, identifying and mitigating risk early in the development lifecycle.
• Perform in-depth secure code reviews and full-scope application security assessments across web, API, cloud, and backend services.
• Build, integrate, and tune application security tooling in CI/CD — SAST, DAST, SCA, secret scanning, and static analysis platforms such as CodeQL.
• Triage, prioritize, and drive remediation of application vulnerabilities with engineering teams, ranking by risk and business impact.
• Develop automation and paved-road tooling to reduce weaknesses and make secure paths the default for developers.
• Serve as the application security SME for engineers and architects, steering secure-by-default patterns.
• Define and mature the secure software development lifecycle (SDLC) and security standards.
• Own or support vulnerability disclosure and bug bounty processes, including root-cause analysis and coordinating fixes.
• Strengthen software supply chain security, including dependency management and build/pipeline integrity.
• Partner with security operations on application-layer incidents and code-level remediation.
• Deliver developer-focused security training and promote a security-aware engineering culture.

Connaissances

Threat modeling

Secure design reviews

Secure coding practices

CI/CD security tooling

Vulnerability remediation coordination

Security training

Communication

Reading production code

Formation

Bachelor’s degree in CS/Cybersecurity

Outils

CodeQL

SAST tooling

DAST tooling

SCA tooling

CI/CD pipelines

Description du poste

ABOUT QUARTERMASTER AI

At Quartermaster AI, we believe the ocean should be a safe and sustainably managed resource for all. By leveraging cutting-edge AI and robotics, we unlock capabilities that were only recently impossible. Our distributed open-ocean systems enable every vessel to sense, compute, and communicate, enhancing maritime domain awareness for those who need it most.

THE ROLE

As our Security Engineer, Application Security, you will own the security of the software we build — our cloud services, APIs, data pipelines, and the applications that run across our distributed, edge-deployed systems. You will be the security partner engineering teams turn to: leading threat models and design reviews, finding and helping fix vulnerabilities in code, and steering the architecture of our products toward secure-by-default.

KEY RESPONSIBILITIES

• Lead threat modeling and secure design reviews for new and existing services, identifying and mitigating risk early in the development lifecycle.
• Perform in-depth secure code reviews and full-scope application security assessments — whitebox, greybox, and blackbox — across web, API, cloud, and backend services.
• Build, integrate, and tune application security tooling in CI/CD — SAST, DAST, SCA, secret scanning, and static analysis platforms such as CodeQL — to catch vulnerabilities before they ship.
• Triage, prioritize, and drive remediation of application vulnerabilities together with engineering teams, ranking work by real-world risk and business impact.
• Develop automation and paved-road tooling that eliminate entire classes of weaknesses and make the secure path the default path for developers.
• Serve as the application security subject-matter expert for engineers and architects, steering product design toward secure-by-default patterns.
• Define and mature the secure software development lifecycle (SDLC), secure coding standards, and security requirements across the engineering organization.
• Own or support the vulnerability disclosure and bug bounty process — scoping, validating submissions, performing root-cause analysis, and coordinating fixes with engineering.
• Strengthen software supply chain security, including dependency management, artifact and commit signing, and build/pipeline integrity.
• Partner with the security operations team on application-layer incidents, providing code-level expertise during investigation and remediation.
• Deliver developer-focused security training and champion a security-aware engineering culture through enablement rather than gatekeeping.

REQUIRED QUALIFICATIONS

• 5–8 years in application security, product security, or software engineering with a strong security focus.
• Software development experience in one or more modern languages (e.g., Python, Go, Java, JavaScript/TypeScript, Rust, or C/C++) and the ability to read and reason about production code.
• Demonstrated experience evaluating code for vulnerabilities and weaknesses, and leading threat modeling and security design reviews.
• Hands-on experience with application security tooling — SAST, DAST, SCA, and static analysis platforms such as CodeQL — and integrating them into CI/CD pipelines.
• Strong understanding of the OWASP Top 10 (web and API), CWE, common vulnerability classes, and secure coding practices.
• Experience securing modern architectures — microservices/SOA, REST/gRPC APIs, containers, and cloud environments (AWS, Azure, or GCP).
• Experience performing black-box and grey-box testing of web applications and APIs.
• Proven track record driving vulnerability remediation by partnering with engineering teams rather than blocking them.
• Excellent written and verbal communication skills, with the ability to influence engineers and explain risk to both technical and non-technical audiences.
• Must be a U.S. citizen.
• Bachelor’s degree in Computer Science, Cybersecurity, or equivalent hands-on experience.

PREFERRED QUALIFICATIONS

• Active U.S. security clearance, or eligibility and willingness to obtain and maintain one.
• Industry certifications such as OSCP, OSWE, GWAPT, GWEB, CSSLP, or Burp Suite Certified Practitioner.
• Experience building “paved road” / secure-by-default frameworks and developer self-service security tooling.
• Experience with software supply chain security (SLSA, in-toto, Sigstore) and artifact/commit signing.
• Experience with infrastructure-as-code and cloud-native security (Terraform, Kubernetes).
• Contributions to bug bounty programs, published CVEs, security research, or open-source security tooling.
• Familiarity with securing embedded, edge, or robotics/IoT software.
• Familiarity with defense-sector compliance frameworks (NIST 800-171, CMMC) as they relate to secure development.
• Prior experience in a startup, defense, intelligence, or critical-infrastructure environment.

WHY JOIN QUARTERMASTER AI?

• Build application security from the ground up for a company defending critical maritime and national-security infrastructure.
• Work with cutting-edge AI and robotics systems in real-world, high-stakes environments.
• Significant autonomy to shape the secure SDLC, tooling, and standards the entire engineering org builds on.
• Competitive salary with comprehensive medical, dental, and vision benefits.
• Flexible remote work with a mission-driven, fast-moving team.
• Career growth in a rapidly scaling defense-tech company at the forefront of maritime AI.