Senior AppSec Engineer - Own Secure-by-Default Apps

Treatwell; United States; Remote; USD 140,000 - 210,000; Full time

Benefits offered by this job

28-days holiday, plus bank holidays

Monthly €40 Treatwell vouchers

Mental health support through Open-Up

Job summary

Treatwell is seeking a Senior Application Security Engineer to own application security across Product Engineering. You will write code, own security tooling in pipelines, and collaborate with multiple teams to fix vulnerabilities found by scanners, annual pentests, and real incidents.

You will work with Java, Spring Boot, Ruby on Rails, React/TypeScript, Swift, and Kotlin across various products and deployments.

Qualifications

• Experience as an application security engineer or as a backend engineer who owned security for a product.
• Ability to read and write production code in Java, Ruby, or TypeScript well enough to pair on a fix.
• Knowledge of the OWASP ASVS and Top 10 from code.
• Experience integrating SAST, dependency scanning or secrets detection into CI pipelines (GitLab CI or GitHub Actions).
• Experience with vulnerability management platforms and driving findings to closure.

Responsibilities

• Own application security across Product Engineering and remediate vulnerabilities in codebases, including auth, sessions, payments and public APIs.
• Own the security tooling across areas (secrets detection, dependency scanning, SAST, DefectDojo) and land SAST in pipelines.
• Make DefectDojo work without a human in the loop with team ownership.
• Build secure defaults into the paved road: auth, session libs, input validation, secrets handling, dependency and container checks in templates.
• Run threat modelling with teams and improve AI-based threat modeller for backlog items.
• Triaging findings and tracking to closure in DefectDojo against severity SLAs.

Skills

Security engineering

Threat modelling

CI/CD

Code review

Communication

Tools

DefectDojo

GitLab CI

GitHub Actions

ArgoCD

Kubernetes (EKS)

Datadog

Job description

Treatwell is seeking a Senior Application Security Engineer to own application security across Product Engineering. You will write code, own security tooling in pipelines, and collaborate with multiple teams to fix vulnerabilities found by scanners, annual pentests, and real incidents.

You will work with Java, Spring Boot, Ruby on Rails, React/TypeScript, Swift, and Kotlin across various products and deployments.