Senior AppSec Engineer - Remote, Threat Modeling in SDLC

CrowdStrike Holdings, Inc.; United States; Remote; USD 140,000 - 215,000; Full time

Benefits offered by this job

Market-leading compensation

Comprehensive benefits

Paid time off

Professional development

Employee networks

Global recognition

Job summary

CrowdStrike Holdings, Inc. is seeking a Senior Application Security Engineer to deepen security across CrowdStrike products.

You will dig into web applications, identify design and implementation flaws, and work with engineers to fix defects while contributing to secure shipping of code. You will drive threat modeling, perform manual secure reviews for Go/Python/JavaScript apps, and strengthen browser security, API protection, and cloud-native configurations across GCP/AWS/Azure.

Qualifications

• 8+ years of experience in CyberSecurity with expertise in identifying security defects and engaging with engineering teams to find solutions.
• Deep understanding of how software products are created and shipped in Agile/DevOps environments.
• Experience with threat model framework(s), especially STRIDE.
• Proven experience in manual secure code review for apps built with Go, Python, or JavaScript.
• Deep expertise in browser security implementations across platforms (Chrome, Firefox) with TypeScript, React, Node.js, Electron.
• Demonstrable proficiency in hands-on review and testing of API endpoint security.
• Working knowledge of secure configuration of cloud-native and containerized apps in GCP/Azure/AWS.
• Experience using/applying AppSec tools (SAST/DAST/CSPM/DSPM/ASPM).
• Strong collaboration across technical teams and ability to influence decisions.
• Experience using AI to enhance decision-making and automate security workflows.

Responsibilities

• Join engineering teams as a security expert and advisor, influencing product design and capabilities.
• Create, maintain, and mature threat models to drive security reviews and reduce threat surface.
• Review application source code for security defects and risks.
• Attack applications throughout the Secure Development LifeCycle.
• Collaborate with developers to explain defects and implement proven solutions.
• Build tools and automation to streamline security tasks for teams.
• Lead responses to bug bounty program and improve security across the platform.

Skills

Cybersecurity experience

Threat modeling STRIDE

Secure code review

Web security

Cloud platforms

AppSec tools

AI in security

Cross-functional collaboration

Education

Security certifications

Tools

SAST tools

DAST tools

CSPM

DSPM

ASPM suites

Job description

CrowdStrike Holdings, Inc. is seeking a Senior Application Security Engineer to deepen security across CrowdStrike products.

You will dig into web applications, identify design and implementation flaws, and work with engineers to fix defects while contributing to secure shipping of code. You will drive threat modeling, perform manual secure reviews for Go/Python/JavaScript apps, and strengthen browser security, API protection, and cloud-native configurations across GCP/AWS/Azure.