Senior App Security Engineer - Secure-by-Default, Remote

Quartermaster; United States; À distance; USD 140 000 - 210 000; Plein temps

Avantages offerts par ce poste

Medical, dental, and vision benefits

Flexible remote work

Autonomy to shape secure SDLC and dev-

Résumé du poste

Quartermaster AI seeks a Security Engineer, Application Security, to own the security of our cloud services, APIs, data pipelines, and edge deployments. You will lead threat models, perform code reviews, and steer architecture toward secure-by-default patterns.

This senior, hands-on role builds tooling and automation for scalable security, partnering with Engineering, Security Ops, and GRC to enable secure delivery across a fast-moving team.

Qualifications

• 5–8 years of experience in application security, product security, or software engineering with a security focus.
• Proficient in one or more modern languages and able to read production code.
• Demonstrated experience evaluating code for vulnerabilities and leading threat modeling and security design reviews.
• Hands-on experience with SAST, DAST, SCA, and CodeQL and integrating them into CI/CD.
• Strong knowledge of OWASP Top 10, CWE, and secure coding practices.
• Experience securing modern architectures (microservices, REST/gRPC, containers, cloud).
• Experience performing black-box and grey-box testing of web apps and APIs.
• Proven track record driving remediation by partnering with engineering teams.
• Excellent communication skills to influence engineers and explain risk.
• U.S. citizen.
• Bachelor’s degree in CS/Cybersecurity or equivalent.

Responsabilités

• Lead threat modeling and secure design reviews for new and existing services.
• Perform in-depth secure code reviews and full-scope security assessments across web, API, cloud, and backend services.
• Integrate and tune application security tooling in CI/CD (SAST, DAST, SCA, CodeQL).
• Prioritize and drive remediation with engineering teams by real-world risk.
• Develop automation to make secure-path the default for developers.
• Serve as security expert guiding secure-by-default patterns.
• Shape secure SDLC and coding standards across the org.
• Own vulnerability disclosure and bug bounty processes when applicable.
• Strengthen software supply chain security (signing, dependencies).
• Support security incident responses with code-level expertise.
• Provide developer-focused security training and enablement.

Connaissances

5–8 years in application security /软件?

Programming in Python/Go/Java/JavaS...

Threat modeling and secure design

Read and reason about production code

CI/CD security tooling integration

OWASP Top 10 knowledge

Cloud/container security (AWS/Azure/Ga

Communication and influencing

U.S. citizen

Formation

Bachelor’s degree in Computer Science, Cybersecurity, or equivalent hands-on experience

Outils

SAST

DAST

SCA

CodeQL

Description du poste

Quartermaster AI seeks a Security Engineer, Application Security, to own the security of our cloud services, APIs, data pipelines, and edge deployments. You will lead threat models, perform code reviews, and steer architecture toward secure-by-default patterns.

This senior, hands-on role builds tooling and automation for scalable security, partnering with Engineering, Security Ops, and GRC to enable secure delivery across a fast-moving team.