Senior Application Security Engineer - Secure by Design

OhioX; Northern (KY); Hybrid; USD 167,000 - 231,000; Full time

Benefits offered by this job

Competitive compensation

Equity grants

401(k) plan with company match

ESPP (US only)

Medical/Dental/Vision

Wellness resources

HSA contributions

Life insurance

Paid time off & holidays

Parental leave

Job summary

Upstart, a digital-first AI lending marketplace, is seeking a Senior Application Security Engineer to lead security projects across products and services. This role collaborates with product, platform, data, infrastructure, and engineering teams to identify risks, review designs, and drive durable improvements while maintaining a positive developer experience.

Location: Remote in the U.S. The position focuses on threat modeling, secure-by-default controls, incident leadership, and automating

Qualifications

• 5+ years in security or software engineering with 2+ years in app security.
• Experience leading security projects with multiple teams.
• Experience threat modeling and security architecture reviews for complex production apps.
• Experience developing production software or security automation in Java, Python, Ruby, Go.
• Experience designing or implementing application security controls across the SDLC (API security, secure coding standards, CI/CD security, secrets management).
• Experience identifying, validating, prioritizing, and driving remediation of application vulnerabilities.
• Experience securing cloud-native or distributed systems.

Responsibilities

• Lead app security projects from planning to implementation.
• Conduct threat modeling and architecture reviews for complex apps and APIs.
• Design secure-by-default controls across the SDLC.
• Partner with engineering to remediate high-risk issues.
• Build automation to improve vulnerability detection and prevention.
• Assess security of AI-enabled products and GenAI workflows.
• Provide technical leadership during high-severity incidents.
• Mentor engineers and strengthen security practices across teams.

Skills

Security engineering

Application security

Lead projects

Threat modeling

Java/Python

Cloud security

Incident response

Tools

SAST

DAST

SCA

CI/CD security

Secrets management

Job description

Upstart, a digital-first AI lending marketplace, is seeking a Senior Application Security Engineer to lead security projects across products and services. This role collaborates with product, platform, data, infrastructure, and engineering teams to identify risks, review designs, and drive durable improvements while maintaining a positive developer experience.

Location: Remote in the U.S. The position focuses on threat modeling, secure-by-default controls, incident leadership, and automating