Senior AppSec Engineer - Remote & Build Secure APIs

Distribusion Technologies; United States; Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Flexible work policy

Remote work worldwide

Job summary

Distribusion Technologies, the world’s leading ground transportation marketplace, seeks a Senior Product/Application Security Engineer to build AppSec from the ground up. You will own secure development and establish gates for a large engineer team, delivering measurable security impact across production within weeks.

You will combine hands-on coding, threat modeling, and security automation in a remote-first, globally distributed team.

Qualifications

• 5+ years in Product/Application Security or 3+ years with strong software engineering/web-pentesting background.
• Read/write production code in Python, Go, TypeScript, Ruby, etc.
• Deep knowledge of web and API security: OAuth2, JWT, rate limiting, tenant isolation, IDOR, XSS.
• Strong cloud security fundamentals (GCP preferred).
• SAST/SCA/secrets scanning in CI/CD.
• threat modelling with STRIDE or similar.

Responsibilities

• Lead threat modeling and secure design reviews for high-risk changes, partner integrations, and payment flows.
• Implement, tune, and enforce security gates in GitLab CI/CD (SAST, SCA, secrets scanning, DAST) while minimizing developer friction.
• Act as the primary technical owner for triaging, reproducing, and prioritizing findings from bug bounties, partner pentests, and scanners.
• Work hands-on with the DevOps team to implement GCP organizational policies and IAM least-privilege architectures, plus Cloud Armor.
• Establish a security-champions network across squads and scale reviews with automation/AI tooling.
• Own vulnerability management end to end: backlog, SLAs, escalation path, and remediation with teams.
• Scope and coordinate annual external penetration tests and produce evidence for PCI-DSS / ISO 27001.

Skills

Python

Go

TypeScript

Ruby

Web security

OAuth2/JWT

CI/CD security gates

GCP

SAST/SCA/secrets scanning

Threat modelling

AI tooling for triage

Multi-tenant APIs

Tools

Snyk

Semgrep

Aikido

Job description

Distribusion Technologies, the world’s leading ground transportation marketplace, seeks a Senior Product/Application Security Engineer to build AppSec from the ground up. You will own secure development and establish gates for a large engineer team, delivering measurable security impact across production within weeks.

You will combine hands-on coding, threat modeling, and security automation in a remote-first, globally distributed team.