Security Engineer II

Spotnana; United States; On-site; USD 110,000 - 170,000; Full time

Benefits offered by this job

Equity

401(k) match

Health coverage

PTO

Holidays

Parental leave

Job summary

Spotnana is seeking a Security Engineer II to join our global Security team. You will focus on application security, improving our security and privacy across the platform and expanding the secure SDLC.

You will work with Engineering and Product to secure API, perform assessments, and drive for best practices. The ideal candidate has 3+ years in web/mobile app security, experience with Java-based microservices, React frontend and cloud deployments, and a strong bias for cross-functional

Qualifications

• 3+ years of web and mobile application security assessment experience.
• Experience securing Java-based, API-driven microservices deployed in a cloud environment.
• Experience with React (JS) for frontend and Java for backend services.
• Previous experience implementing secure SDLC practices, and automations such as SAST, DAST, RAST, IAST in at least medium scale software development organizations.
• Ability to write code in one or more programming languages.

Responsibilities

• Conduct application level security assessments (threat modeling, code reviews, penetration testing) of both internal tools and external Spotnana web and mobile applications.
• Provide supporting guidance for bug-fixes on issues found through various channels (customer reported, internal testing, tools, external pen tests etc).
• Incorporate AI tools to accelerate our ability to detect and address application security vulnerabilities.
• Develop API Security best practices.
• Implement SAST, DAST, RAST, IAST and related tools to identify security bugs earlier in the release cycle.
• Deliver training and awareness for R&D on security issues.
• Be part of incident response team where application level context and triage is necessary to contain an issue.
• Collaborate with security compliance functions to align technical controls with compliance requirements.

Skills

Web security assessment

Java backend

API security

React frontend

Cloud security

Secure SDLC

SAST/DAST/IAST

Job description

Let’s Build What’s Next, Together.

We are Spotnana. We’re on a mission to modernize the infrastructure of the $11.7 trillion travel industry to power the perfect trip for travelers everywhere. Our Travel-as-a-Service platform is designed to make every trip better, whether someone is booking for work or leisure travel, building a travel tool, or looking to offer personalized experiences at scale.

We’re not just modernizing tech, we’re rethinking how the industry works.

At Spotnana, our values and principles guide how we work and grow together:

• Build the future – We are leaders, we are innovators, we are ambitious.


• Commit to excellence – We’re accountable, we are partners, we are agile.


• Stronger together – We lead with respect and integrity, we are inclusive, we are lifelong learners.

The opportunity ahead

Spotnana is seeking an Security Engineer II to join our global Security team. As an Security Engineer II focused on Application Security, you will be responsible for improving Spotnana’s security and privacy position across our platform. As a hands‑on engineer, you will work closely with Spotnana Engineering and Product teams to expand our secure SDLC, own our API security and penetration testing processes, and advocate for best‑practices across our codebase including incorporation of security reviews earlier in our development cycle. The ideal candidate has a strong engineering background and is passionate about working cross‑functionally with R&D teams to deliver secure, scalable solutions while being able to describe the business value provided by reducing risks.

How You’ll Help Us Build

• Conduct application level security assessments (threat modeling, code reviews, penetration testing) of both internal tools and external Spotnana web and mobile applications


• Provide supporting guidance for bug‑fixes on issues found through various channels (customer reported, internal testing, tools, external pen tests etc)


• Incorporate AI tools to accelerate our ability to detect and address application security vulnerabilities


• Develop API Security best practices


• Implement SAST, DAST, RAST, IAST and related tools to identify security bugs earlier in the release cycle


• Deliver training and awareness for R&D on security issues


• Be part of incident response team where application level context and triage is necessary to contain an issue


• Collaborate with security compliance functions to align technical controls with compliance requirements

Experience You Bring

• 3+ years of previous web and mobile application security assessment experience


• Experience securing Java-based, API‑driven microservices deployed in a cloud environment


• Experience with React (JS) for frontend and Java for backend services


• Previous experience implementing secure SDLC practices, and automations such as SAST, DAST, RAST, IAST in at least medium scale software development organizations


• Ability to write code in one or more programming languages

What To Expect Next

Selected candidates will participate in cross‑functional virtual interviews exploring their relevant experience, approach to problem solving, critical thinking, and alignment with Spotnana’s core values. Interviews will include face‑to‑face conversations as well as coding exercises to demonstrate your ability.

Work Authorization

This position is not eligible for employment‑based visa sponsorship. Candidates must be legally authorized to work in the United States and must not require current or future employment sponsorship.

Let’s Talk Compensation

Spotnana strives to offer fair, industry‑competitive, and equitable compensation. Our total compensation package includes base salary, an annual performance bonus, company equity, and comprehensive benefits. We use trusted third‑party market data to establish compensation ranges that are competitive for the role, industry, company size, and geographic market, while maintaining internal equity across our team.

Compensation is determined based on a variety of factors, including skills, experience, qualifications, and work location. The anticipated annual base salary hiring ranges for this role are:

• New York Metro Area, San Francisco Bay Area, Seattle Metro Area: $126,000-$170,000


• California, New Jersey, Washington, New York, Washington, D.C., Massachusetts, Connecticut: $120,500-$163,000


• Hawaii, Alaska, Maryland, Illinois, New Hampshire, Oregon, Colorado, Virginia, Delaware, Minnesota, Rhode Island, Pennsylvania, Texas: $115,000-$155,000


• All other U.S. states: $109,500-$147,000

Actual compensation may vary based on individual qualifications and the applicable geographic market.

Benefits

We care for the people who make everything possible - our benefits offerings include:

• Equity in the form of stock options, which provides partial ownership in the company, so you can share in the success of the company as it grows


• Pre‑tax and ROTH 401(k) options via Fidelity with up to a 4% company match


• Comprehensive benefit plans covering medical, dental, vision, life, and disability effective on your hire date. We cover 100% of your employee premiums and 85% of your eligible dependents


• Pre‑tax flexible spending account options for health, dependent care, and commuter expenses


• Flexible PTO in addition to 10 company holidays and an end‑of‑year company shutdown


• Up to 26 weeks of Parental Leave


• Monthly cell phone/internet stipend


• Extra perks — IATAN travel membership, pet insurance, financial wellness tools, Calm app access, and more

We are committed to fostering a diverse, inclusive environment and to encourage these values in everyone on our team. We provide an environment of mutual respect where opportunities are available without regard to race, color, religion, sex, pregnancy (including childbirth, lactation and related medical conditions), national origin, age, physical and mental disability, marital status, sexual orientation, gender identity, gender expression, genetic information (including characteristics and testing), military and veteran status, and any other characteristic protected by applicable law. We believe that diversity and inclusion for people from all walks of life is key to our success as a company.