Senior Security Application Engineer

Bitgo; Palo Alto (CA); Hybrid; USD 180,000 - 240,000; Full time

Benefits offered by this job

Company-paid medical, dental, and vis​

Catered lunches, snacks, coffee

Caltrain passes

Stock options

401k plan

Flexible vacation time

Remote/hybrid friendly workspace

Top-end computer equipment

Job summary

Bitgo seeks a Senior Application Security Engineer to lead our product security program for FinTech and Web3 platforms. You will guide threat modeling, security reviews, and security automation integrated into the software development lifecycle.

You will architect secure AWS environments with Terraform and Kubernetes, design encryption and KMS solutions, and oversee incident response and penetration testing. Experience securing AI/ML lifecycles is highly valued.

Qualifications

• Deep engineering background defending complex cloud environments.
• Experience securing FinTech, Web3, and digital asset ecosystems.
• Practical knowledge implementing controls for SOC 2 Type II and GDPR.

Responsibilities

• Lead threat modeling and security architecture reviews with cross-functional teams.
• Integrate security automation into CI/CD using SAST/DAST and vulnerability management.
• Architect and implement secure AWS infrastructure using Terraform and Kubernetes.
• Design encryption services, key management systems, and data protection controls.
• Oversee bug bounty programs, incident response workflows, and penetration testing.
• Secure AI/ML lifecycles and establish LLM guardrails.
• Engineer defenses for cloud platform infrastructure against advanced threats.

Skills

Threat modeling

Security architecture

Security automation

SAST

DAST

Vulnerability management

AWS security

Terraform

Kubernetes

Encryption / KMS

Incident response

Penetration testing

AI/ML security

Distributed systems

Python/Java

Education

Bachelor’s degree in Computer Science / Engineering

Tools

Terraform

Kubernetes

AWS

Job description

• We are seeking a Senior Application Security Engineer to lead the technical execution of our product security strategy
• This role focuses on securing high-growth FinTech and Web3 digital asset platforms by building end-to-end security programs and integrating automated security controls directly into the software development lifecycle
• Lead comprehensive threat modeling and product security architecture reviews in collaboration with cross-functional teams
• Integrate security automation into CI/CD pipelines utilizing SAST, DAST, and continuous vulnerability management tools
• Architect and implement secure-by-default cloud infrastructure on AWS using Terraform and Kubernetes
• Design and deploy robust encryption services, key management systems (KMS), and advanced data protection controls across distributed environments
• Oversee operational security initiatives including corporate bug bounty programs, incident response workflows, and regular penetration testing engagements
• Secure next-generation AI-integrated applications by establishing input/output validation protocols and LLM guardrails
• Engineer proactive defenses to safeguard platform infrastructure against sophisticated adversaries and nation-state-level threats

Benefits

• Company-paid medical, dental, and vision plans
• Catered lunches, fresh snacks, and gourmet coffee
• Commuting made easy with company-paid Caltrain passes
• Competitive compensation, stock options, and 401k plan
• Flexible vacation time
• Remote/hybrid friendly with physical location workspaces
• Top-end computer equipment to power your work

The ideal candidate has a deep engineering background, hands-on experience defending complex cloud environments, and a passion for securing blockchain-adjacent technologiesProven background securing platforms within FinTech, Web3, and digital asset ecosystemsPractical knowledge of implementing technical controls to meet SOC 2 Type II and GDPR compliance standardsBachelor’s degree in Computer Science, Engineering, or an equivalent technical fielDeep expertise in securing AI/ML lifecycles, MLOps frameworks, and agentic AI platformsStrong engineering proficiency in distributed systems, microservices, and languages such as Python or Java8+ years of experience engineering and scaling end-to-end security programs for high-growth startupsHands-on mastery of container security, Kubernetes orchestration, and AWS infrastructure hardening