Senior AppSec Engineer: Automate Security & Risk (Remote)

Sardine; United States; Remote; USD 140,000 - 195,000; Full time

Benefits offered by this job

Remote-first culture

Health insurance for employees and (US

401(k) match

Job summary

Sardine is seeking an experienced security engineer to own and automate vulnerability management across our risk platform. You will triage findings from SAST/DAST/SCA, build pipelines to reduce manual work, and drive root-cause fixes across multi-cloud services.

You will work hands-on with Go, Node.js, Python, Ruby, and Java services, shaping secure defaults and patterns. This remote-first role offers strong compensation and growth within a fast-growing fintech security team.

Qualifications

• Vulnerability management, automated end to end with code against scanner, ticketing, and source-control APIs.
• Engineering background with real software deliverables.
• Ownership to finish including cross-team fixes.
• Judgment over tenure; depth matters more than years.
• Code auditing in Go, Python, Node.js, Ruby, or Java, plus others.
• Practical knowledge of OWASP Top 10, especially broken access control and business logic flaws.
• SAST, DAST, SCA in CI/CD; cloud fundamentals on GCP or AWS; Docker and Kubernetes.
• Distinguish real findings from theoretical ones; communicate with evidence.
• Influence across time zones asynchronously.

Responsibilities

• Triage, validate, route, and drive remediation of findings from SAST, DAST, SCA, code review, pentests, and bug bounty.
• Build automation to remove manual effort from security finding steps.
• Direct external pentests and bug bounty scope, judge severity, and close the loop.
• Spot patterns across findings to remove root causes, not just instances.
• Set secure patterns and defaults that make the right way the easy way.
• Write custom static analysis rules (Semgrep, CodeQL) for anti-patterns.
• Review platform controls (authorization, secrets handling, gateway enforcement) and drive fixes.
• Collaborate with engineers on fixes that are simple, adopted, and durable.
• Hands-on testing of apps and APIs, with depth in authorization and business logic.
• Threat modeling on new designs and security enablement across engineering.

Skills

Vulnerability management

Engineering background

Ownership to done

Judgment over tenure

Code auditing (Go/Python/Node.js/Ruby/

OWASP Top 10

SAST/DAST/SCA in CI/CD

Cloud fundamentals (GCP/AWS)

Docker and Kubernetes

Evidence-based discussion

Tools

Semgrep

CodeQL

CI/CD tooling

Job description

Sardine is seeking an experienced security engineer to own and automate vulnerability management across our risk platform. You will triage findings from SAST/DAST/SCA, build pipelines to reduce manual work, and drive root-cause fixes across multi-cloud services.

You will work hands-on with Go, Node.js, Python, Ruby, and Java services, shaping secure defaults and patterns. This remote-first role offers strong compensation and growth within a fast-growing fintech security team.