Senior Application Security Engineer

VulnU; United States; Remoto; USD 135.000 - 180.000; Tempo pieno

Vantaggi offerti da questo lavoro

Generous compensation and equity

Remote-first / work from anywhere

Flexible PTO and year-end break

Health, dental, and vision for depend-

401k matching

Home office setup stipend

Monthly meal stipend

Annual learning stipend

Descrizione del lavoro

Sardine is seeking a Senior Application Security Engineer to help secure our fraud platform. You will own vulnerability management, perform threat modeling, and automate the security pipeline across Go, Node.js, Python, Ruby, and Java services in multi-cloud environments.

You will triage findings from SAST, DAST, SCA, pen tests, and bug bounty, write custom static analysis rules, review authorization controls, and collaborate with engineers across time zones in a fully distributed, remote-first

Competenze

• Vulnerability management end-to-end with automation.
• Engineering background; able to read and review real software.
• Ownership to done across teams; follow up on fixes.
• Judgment over tenure; depth of knowledge matters more than years.
• Code auditing in Go, Python, Node.js, Ruby or Java.
• Practical command of OWASP Top 10, with focus on broken access control.
• SAST, DAST, SCA in CI/CD; cloud fundamentals on AWS/GCP.
• Docker and Kubernetes; asynchronous collaboration across time zones.

Mansioni

• Run and automate the vulnerability pipeline across sources.
• Triage, validate, route, and drive remediation of findings.
• Build automation to remove manual effort from remediation steps.
• Direct external pentests and bug bounty scope; judge severity; close loop.
• Review platform controls and push owners to fix gaps with evidence.

Conoscenze

Vulnerability management

Code auditing

Go

Python

Java

Node.js

Ruby

AWS

GCP

Docker

Kubernetes

SAST/DAST/SCA

PCI DSS / SOC 2

Bug bounty / pentesting

Formazione

Engineering degree or equivalent

Strumenti

Semgrep

CodeQL

CI/CD tooling

Descrizione del lavoro

# Senior Application Security EngineerSardine · sardine.aiCategory: Application SecurityLocation: RemoteLevel: SeniorSalary: $135,000 – $180,000## Quality of lifeWhat the posting states. Hover or tap a perk to see the line it came from.* Flexible PTO* Retirement match* Learning budget* EquityWho we are:Sardine is the leading agentic risk platform for fighting financial crime. Our integrated solution unifies data across risk teams to help organizations stop fraud in real time, prevent AI-driven attacks, and automate fraud and AML operations. Sardine’s platform is strengthened by one of the fastest-growing fraud consortiums in the market, spanning more than 6 billion profiled devices, 800 million consumers, and 3 million businesses worldwide. Leading companies including FIS, GoDaddy, Intuit, Edward Jones, ZoomInfo, and Checkout.com rely on Sardine to secure and grow trust in their products.Our culture:We hire talented, self-motivated individuals with extreme ownership and high growth orientation.We value performance and not hours worked. We believe you shouldn't have to miss your family dinner, your kid's school play, friends get-together, or doctor's appointments for the sake of adhering to an arbitrary work schedule.We're a remote-first team spread across time zones, so no office to report to - work from wherever helps you do your best work. Just a couple of things to keep in mind: pay is based on where you're located, and you'll need to keep a home base in the country you're hired in. So while we love the \"coffee shop today, mountains tomorrow\" life, this isn't a passport-optional, work-from-anywhere-on-Earth kind of remote - think flexible within your country, not borderless.Location:Remote - United StatesThe roleSardine makes risk and payment decisions for banks and fintechs. Our customers audit us closely, and application security is a large part of what they examine.Money moves through this platform, so real adversaries study it. Your job is to find what they would find, especially authorization flaws and business logic abuse, and then make the whole class of bug go away.The application security team is small. The estate is large: Go, Node.js, Python, Ruby, and Java services running on multi-cloud and Kubernetes. That ratio shapes the work. Findings arrive from scanners, code review, testing, threat modeling, pentesters, and bug bounty hunters. You turn that stream into a pipeline that validates, routes, and closes issues with as little manual effort as possible. Then you use what the pipeline tells you to remove root causes: secure defaults, patterns engineers reach for first, and fixes that hold.Little here is pre-decided. You determine where the risk is and go after it.The workWhere most of your time goesRunning and automating the vulnerability pipelineTriage, validate, route, and drive remediation of findings from every source: SAST, DAST, SCA, code review, pentests, and bug bountyBuild the automation that removes manual effort from each of those stepsExternal pentests and bug bounty program: set scope, direct the testers, judge severity, and close the loopMaking bug classes go awaySpot the patterns across findings and remove the root cause, not just the instanceSet the secure patterns and defaults that make the right way the easy wayWrite custom static analysis rules for our own anti-patterns, so a fixed bug class stays fixedReview platform-layer controls (authorization, service identity, secrets handling, gateway enforcement), find the gaps, and push the owning teams until they are closedWork alongside engineers on fixes that are simple, get adopted, and holdAlso part of the jobHands-on testing of our applications and APIs, and manual code review of high-exposure services, with depth in authorization and business logicThreat modeling on new and high-exposure designsSecurity enablement across engineering, including a security champions programWhat we're looking forVulnerability management, automated. Experience running vulnerability management end to end, and automating it with code against scanner, ticketing, and source-control APIsAn engineering background. You have shipped and maintained real software. You read unfamiliar code quickly, review it rigorously, and reason about architecture and failure modes.Ownership to done. You take problems all the way through, including fixes that depend on other teams. You follow up on the fix you recommended three sprints ago.Judgment over tenure. We care more about the depth of your judgment than your years of experience.Code auditing in at least one of Go, Python, Node.js, Ruby, or Java, and the willingness to work in the restPractical command of the OWASP Top 10, with real depth in broken access control and business logic flawsSAST, DAST, and SCA in CI/CD, tuned so engineers trust the output. Cloud fundamentals on GCP or AWS. Docker and Kubernetes.You separate real findings from theoretical ones.You disagree in the open, with evidence, and update when someone brings better evidence.Your influence travels asynchronously, across time zones, to people with strong opinions and no reporting line to you.BonusScaling security tooling across many repositories, languages, and build systemsPrior experience writing custom static analysis rules (Semgrep, CodeQL, or similar)Fintech, payments, or other environments under serious third-party security review (PCI DSS, SOC 2, customer audits)Fully distributed, asynchronous engineering experienceOffensive experience in whatever form you found it. Pentesting on web, API, mobile, or cloud is the most directly relevant. Hardware and embedded work, physical security and lock sport, red team engagements, protocol and radio work, and CTF or bug bounty results all count.Advanced offensive certifications. OSWE and BSCP are the most relevant; CPTS, CRTO, and similar also count.Public work: research, tooling, disclosures, talksBenefits we offer:Generous compensation in cash and equityEarly exercise for all options, including pre-vestedWork from anywhere: Remote-first CultureFlexible paid time off and Year-end breakHealth insurance, dental, and vision coverage for employees and dependents - US and Canada specific4% matching in 401k / RRSP - US and Canada specificMacBook Pro delivered to your doorOne-time stipend to set up a home office — desk, chair, screen, etc.Monthly meal stipendMonthly social meet-up stipendAnnual health and wellness stipendAnnual Learning stipendJoin a fast-growing company with world-class professionals from around the world. If you are seeking a meaningful career, you found the right place, and we would love to hear from you.To learn more about how we process your personal information and your rights in regards to your personal information as an applicant and Sardine employee, please visit our Applicant and Worker Privacy Notice.