Senior Security Engineer — Secure SDLC & Pen Tests (Remote)

ButterflyMX, Inc.; United States; Remote; USD 170,000 - 200,000; Full time

Benefits offered by this job

Medical, Dental and Vision plans

401(k) plan with a match

Paid holidays and vacation

Short/Long-term disability

Employee assistance program

Quarterly stipends

Flexible spending accounts (FSA/HSA)

Job summary

ButterflyMX is seeking a Senior Security Engineer to drive application security across the full software development lifecycle. You will lead threat modeling, secure code reviews, and vulnerability management, building internal tooling for the defender’s loop.

You’ll partner with product teams to embed security early in development and own our active testing program. You will work cross-functionally to embed reusable secure patterns, scale security, and influence security architecture decisions.

Qualifications

• 5+ years of application security experience including secure SDLC and offensive testing.
• Strong knowledge of web app and API security fundamentals (OWASP, MITRE, CIS).
• Experience with SAST/DAST/SCA ASPM tools.
• Proficiency in scripting languages to review code and build tooling.
• Experience conducting modern web and mobile pentests.
• Familiar with cloud security (AWS) and container security (Kubernetes).
• Excellent written and verbal communication; translate risk for non-technical stakeholders.
• Certifications (OSCP, GWAPT, GPEN, CEH or similar) a plus.

Responsibilities

• Lead application security reviews, threat modeling sessions, and secure code reviews for new features and product changes.
• Operate and improve SAST, DAST, and SCA tooling; triage findings with engineering teams to harden the codebase.
• Plan and execute internal penetration tests against web apps, APIs, and mobile clients; coordinate third-party assessments.
• Own the vulnerability management lifecycle from discovery to validation.
• Develop and maintain secure coding standards, developer guidance, and training materials.
• Integrate security tooling into CI/CD pipelines and promote shift-left security across the SDLC.
• Investigate security incidents and bug bounty submissions; provide root cause analysis and remediation recommendations.
• Partner with Product and Engineering on security architecture for new features.
• Stay current on threats, CVEs, and attack techniques relevant to our stack.

Skills

Application security

Threat modeling

Secure code review

Penetration testing

SAST/DAST/SCA tooling

CI/CD security

Security architecture

Cloud security (AWS)

Kubernetes security

Communication skills

Tools

SAST tools

DAST tools

SCA tools

CI/CD tooling

Job description

ButterflyMX is seeking a Senior Security Engineer to drive application security across the full software development lifecycle. You will lead threat modeling, secure code reviews, and vulnerability management, building internal tooling for the defender’s loop.

You’ll partner with product teams to embed security early in development and own our active testing program. You will work cross-functionally to embed reusable secure patterns, scale security, and influence security architecture decisions.