Senior AppSec Engineer — Build Secure Defenses (Remote)

Sardine; Oregon; Hybrid; USD 130,000 - 180,000; Full time

Job summary

Sardine is seeking a strong security engineer to own and automate the vulnerability management lifecycle across SAST, DAST, SCA, code reviews, pentests, and bug bounty. You will drive remediation, define secure defaults, and develop patterns that prevent reoccurrence while collaborating with multi-cloud services and engineers across Go, Python, Node.js, Ruby, and Java.

The ideal candidate has hands-on testing of applications and APIs, deep knowledge of authorization and business logic flaws, and

Qualifications

• Experience running vulnerability management end-to-end and automating it with code against scanners, ticketing, and source-control APIs.
• Engineering background with shipped and maintained software; ability to read unfamiliar code quickly and reason about architecture.

Responsibilities

• Triage, validate, and remediate findings from SAST, DAST, SCA, code review, pentests, and bug bounty.
• Build automation to remove manual effort across vulnerability workflows.
• Lead external pentests and bug bounty scope, direction, severity, and closure.
• Review platform controls (authorization, secrets handling, service identity) and push teams to close gaps.
• Collaborate with engineers to implement fixes that are easy to adopt and durable.

Skills

Vulnerability mgmt

Software engineering

Ownership to done

Judgment over tenure

Code auditing

OWASP Top 10

Job description

Sardine is seeking a strong security engineer to own and automate the vulnerability management lifecycle across SAST, DAST, SCA, code reviews, pentests, and bug bounty. You will drive remediation, define secure defaults, and develop patterns that prevent reoccurrence while collaborating with multi-cloud services and engineers across Go, Python, Node.js, Ruby, and Java.

The ideal candidate has hands-on testing of applications and APIs, deep knowledge of authorization and business logic flaws, and