Senior Application Security Engineer

pennylane; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

pennylane is seeking an Application Security Engineer to help protect its web products and supporting infrastructure. You will work with product, engineering, and DevOps teams to embed security into development, conduct code reviews, and manage vulnerabilities.

The role covers incident investigations, security assessments, and ISO 27001 compliance activities, plus training and building secure development materials.

Qualifications

• Application security experience covering code, dependencies, infrastructure, and configuration.
• Ability to conduct secure code reviews and identify practical remediation steps.
• Experience with vulnerability assessment and incident investigation.
• Familiarity with cloud infrastructure and Kubernetes security.
• Ability to embed security in delivery workflows and communicate practices clearly.
• Knowledge of development security controls relevant to ISO 27001 compliance.

Responsibilities

• Partner with product teams to incorporate security considerations from feature design through release.
• Review application code, dependencies, infrastructure, and configuration, and assess code changes from a secure development perspective.
• Identify vulnerabilities, recommend fixes, and improve CI/CD security.
• Work with DevOps to secure cloud infrastructure and its Kubernetes environment.
• Coordinate security assessments, including code reviews, penetration tests, and bug bounty findings.
• Investigate security incidents, examine logs, contain attacks, and recommend measures to reduce recurrence.
• Support development-related ISO 27001 controls through audits, project monitoring, training, and vulnerability and patch management practices.

Skills

Application security

Code reviews

Vulnerability assessment

Incident investigation

Tools

Kubernetes security

Cloud infrastructure

CI/CD tooling

Job description

Role overview

Help protect a web application and its supporting infrastructure by building security into product development, managing vulnerabilities, and guiding engineering teams on secure practices. The role combines hands-on technical review and incident response with security assessments, compliance work, and developer education. You’ll work closely with product, engineering, and infrastructure colleagues as part of a small technical security team.

Responsibilities

• Partner with product teams to incorporate security considerations from feature design through release.


• Review application code, dependencies, infrastructure, and configuration, and assess code changes from a secure development perspective.


• Identify vulnerabilities, recommend fixes, and improve CI/CD security.


• Work with DevOps to secure cloud infrastructure and its Kubernetes environment.


• Coordinate security assessments, including code reviews, penetration tests, and bug bounty findings.


• Investigate security incidents, examine logs, contain attacks, and recommend measures to reduce recurrence.


• Support development-related ISO 27001 controls through audits, project monitoring, training, and vulnerability and patch management practices.


• Create secure development materials, run training, and encourage participation in a Security Champions program.

Requirements

• Application security experience covering code, dependencies, infrastructure, and configuration.


• Ability to conduct secure code reviews and identify practical remediation steps.


• Experience with vulnerability assessment and incident investigation.


• Familiarity with cloud infrastructure and Kubernetes security.


• Ability to work with developers and product teams to embed security in delivery workflows and communicate practices clearly.


• Knowledge of development security controls relevant to ISO 27001 compliance.

Nice to have

• Experience with Ruby on Rails and React applications, AWS EKS, CI/CD security, penetration testing, or bug bounty programs would be relevant to the systems and activities described.