Senior AppSec Engineer — Fintech at Scale

Kikoff; San Francisco (CA); On-site; USD 268,000 - 321,000; Full time

Job summary

Kikoff is seeking a Senior Security Engineer to shape the Application Security pillar across web, mobile, and API surfaces. You will drive the strategy, secure the SDLC, and build tooling for SAST, SCA, secrets scanning, and CI integration to keep engineering fast and secure.

You will own authentication systems, API/mobile security, and AI-assisted review processes, ensuring compliance with PCI-DSS, SOC 2, and IPO readiness.

Qualifications

• 6+ years in security engineering with deep, hands-on application security experience: secure code review, threat modeling, vulnerability triage, and remediation at scale.
• You write production code in at least one of Ruby, Python, Go, or TypeScript.
• You have designed and shipped authentication and authorization systems: OAuth/OIDC, session management, MFA, account recovery.
• Hands-on with modern AppSec tooling and the judgment to know when it is wrong: SAST, SCA, DAST, secrets scanning, CI/CD integration.
• Experience securing REST/GraphQL APIs and native mobile applications.
• You have run or built a pentest or bug bounty program.
• Comfortable in a fintech regulated environment: PCI-DSS, SOC 2, IPO-readiness.

Responsibilities

• Drive the application security roadmap: secure SDLC, code review, threat modeling, vulnerability management, and pentest programs.
• Set the standard for secure code and build tooling to enforce it: SAST, SCA, secrets scanning, CI integration.
• Decide how AI-generated code gets reviewed and gated; design controls for AI agents as contributors.
• Own security for authentication and session management: MFA design, account recovery, session management.
• Secure APIs and mobile apps: authorization models, rate limiting, device trust, and data protection.
• Protect AI features with defenses for prompt injection and data exposure in LLM-backed flows.
• Lead vulnerability management and auditor-ready evidence for PCI-DSS, SOC 2, IPO readiness.

Skills

Secure coding

Threat modeling

Vulnerability triage

Code review

Programming languages

Tools

SAST

SCA

DAST

Secrets scanning

CI/CD integration

Job description

Kikoff is seeking a Senior Security Engineer to shape the Application Security pillar across web, mobile, and API surfaces. You will drive the strategy, secure the SDLC, and build tooling for SAST, SCA, secrets scanning, and CI integration to keep engineering fast and secure.

You will own authentication systems, API/mobile security, and AI-assisted review processes, ensuring compliance with PCI-DSS, SOC 2, and IPO readiness.