Senior Application Security Engineer: Secure DevOps & Cloud

pennylane; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

pennylane is seeking an Application Security Engineer to help protect its web products and supporting infrastructure. You will work with product, engineering, and DevOps teams to embed security into development, conduct code reviews, and manage vulnerabilities.

The role covers incident investigations, security assessments, and ISO 27001 compliance activities, plus training and building secure development materials.

Qualifications

• Application security experience covering code, dependencies, infrastructure, and configuration.
• Ability to conduct secure code reviews and identify practical remediation steps.
• Experience with vulnerability assessment and incident investigation.
• Familiarity with cloud infrastructure and Kubernetes security.
• Ability to embed security in delivery workflows and communicate practices clearly.
• Knowledge of development security controls relevant to ISO 27001 compliance.

Responsibilities

• Partner with product teams to incorporate security considerations from feature design through release.
• Review application code, dependencies, infrastructure, and configuration, and assess code changes from a secure development perspective.
• Identify vulnerabilities, recommend fixes, and improve CI/CD security.
• Work with DevOps to secure cloud infrastructure and its Kubernetes environment.
• Coordinate security assessments, including code reviews, penetration tests, and bug bounty findings.
• Investigate security incidents, examine logs, contain attacks, and recommend measures to reduce recurrence.
• Support development-related ISO 27001 controls through audits, project monitoring, training, and vulnerability and patch management practices.

Skills

Application security

Code reviews

Vulnerability assessment

Incident investigation

Tools

Kubernetes security

Cloud infrastructure

CI/CD tooling

Job description

pennylane is seeking an Application Security Engineer to help protect its web products and supporting infrastructure. You will work with product, engineering, and DevOps teams to embed security into development, conduct code reviews, and manage vulnerabilities.

The role covers incident investigations, security assessments, and ISO 27001 compliance activities, plus training and building secure development materials.