Senior AppSec Engineer: Secure Coding & Threat Modeling

CrowdStrike; United States; On-site; USD 160,000 - 250,000; Full time

Job summary

CrowdStrike in the United States is seeking a Senior Application Security Engineer to protect our applications and ship secure code on a mission-driven platform. You will dig into web apps, fix defects, and influence security across engineering teams.

You will build threat models, review code in Go, Python, or JavaScript, and help harden our products while automating security tasks and driving secure development practices.

Qualifications

• 10+ years in CyberSecurity with ability to identify defects and work with engineering teams to fix them.
• Deep understanding of software product lifecycles in Agile/DevOps environments.
• Experience with threat modeling frameworks, especially STRIDE.
• Proven hands-on secure code review for apps built with Go, Python, or JavaScript.
• Strong browser security expertise across Chrome/Firefox on desktop and mobile (TypeScript, React, Node.js, Electron).
• Experience reviewing and testing API endpoint security.
• Working knowledge of cloud-native and containerized apps in AWS, Azure, GCP.
• Experience using/applying SAST, DAST, CSPM, DSPM, ASPM suites.
• Solid understanding of common weaknesses beyond OWASP Top 10 and app penetration testing.
• Demonstrated ability to collaborate across technical teams.

Responsibilities

• Join engineering teams as a security expert and advisor, shaping product security.
• Create and mature threat models to reduce attack surface.
• Review application source code for security defects and risks.
• Attack applications throughout the Secure Development LifeCycle.
• Work with developers to explain defects and implement proven fixes.
• Build integrated tools and automation to aid security.
• Lead bug bounty responses, hunt for similar issues, strengthen app security.

Skills

Cybersecurity experience

Agile/DevOps

Threat modeling STRIDE

Secure code review (Go/Python/JS)

Browser security (TypeScript/React/JS)

API security testing

Cloud-native / multi-cloud

AppSec tooling (SAST/DAST/CSPM/DSPM/AS

OWASP & AppPenTesting

Cross-team collaboration

Automation for AppSec tasks

AI for security workflows

Tools

SAST

DAST

CSPM

DSPM

ASPM

Job description

CrowdStrike in the United States is seeking a Senior Application Security Engineer to protect our applications and ship secure code on a mission-driven platform. You will dig into web apps, fix defects, and influence security across engineering teams.

You will build threat models, review code in Go, Python, or JavaScript, and help harden our products while automating security tasks and driving secure development practices.