Senior Application Security Engineer: Secure SDLC & OSS

Glean; United States; Remote; USD 185,000 - 260,000; Full time

Benefits offered by this job

Home office stipend

Education stipend (annual)

Wellness stipend (annual)

401k matching

Job summary

Glean is seeking an experienced Application Security Engineer to secure our platform against CVEs and OSS risks. You will own the vulnerability management lifecycle, harden base OS images, and integrate SAST, DAST, and dependency scanning into CI/CD pipelines.

The role requires 8+ years in application security, with deep knowledge of OWASP Top 10 and supply chain risks, plus hands-on work with Snyk, Dependabot, Trivy, Clair, Burp Suite, and OWASP ZAP across AWS and GCP. Remote work is available.

Qualifications

• 8+ years of experience in application security and vulnerability management.
• Deep understanding of CVEs, OWASP Top 10, and supply chain risks.
• Experience with SAST, DAST, and dependency scanning tools.
• Hands-on cloud security across AWS and GCP, containers and Kubernetes.

Responsibilities

• Own the vulnerability management lifecycle from discovery to remediation.
• Harden base OS images and secure OSS dependencies.
• Integrate SAST, DAST, and dependency scanning into CI/CD pipelines.
• Evaluate and adopt new security tooling and practices.
• Define secure-coding practices and mentor engineers.

Skills

Application security

Vulnerability management

Cloud security

Security tooling

Education

BA/BS in Computer Science, Cybersecurity, or related field

Tools

Snyk

GitHub Dependabot

Trivy

Clair

Burp Suite

OWASP ZAP

Job description

Glean is seeking an experienced Application Security Engineer to secure our platform against CVEs and OSS risks. You will own the vulnerability management lifecycle, harden base OS images, and integrate SAST, DAST, and dependency scanning into CI/CD pipelines.

The role requires 8+ years in application security, with deep knowledge of OWASP Top 10 and supply chain risks, plus hands-on work with Snyk, Dependabot, Trivy, Clair, Burp Suite, and OWASP ZAP across AWS and GCP. Remote work is available.