Sr. Application Security Engineer

Pax8 Philippines Inc.; United States; Remoto; USD 140.000 - 180.000; Tempo pieno

Descrizione del lavoro

Pax8 Philippines Inc. is hiring a Senior Application Security Engineer to own security across cloud-based products, AI-enabled features, and financial platforms from a remote US-based location.

You will partner with engineering leaders to influence secure design, conduct threat modeling, perform manual code review, and manage the vulnerability lifecycle beyond automated findings, while embedding security into developer workflows and pipelines.

Competenze

• Substantial application or product security experience with engineering teams.
• Threat modeling and manual code review for web and microservice environments.
• Strong understanding of authorization, multi-tenant isolation, and business-logic vulnerabilities.
• Hands-on tooling for source-code analysis, dependency analysis, dynamic testing, and secret detection in CI/CD.
• Ability to distinguish a noisy security finding from an exploitable risk and explain remediation clearly.
• Experience creating automation or engineering tooling for vulnerability management, including AI/agents.
• Practical understanding of security risks in AI-assisted development, including prompt injection and data-exfiltration paths.
• Proficiency with at least one modern cloud-native language; comfortable reading Kotlin/JS/TS.
• Working knowledge of AWS, Kubernetes, containers, and infrastructure as code.
• Bonus in agentic security or Model Context Protocol integrations.
• Confidence to challenge a design constructively.

Mansioni

• Be a trusted security partner to your product area, working alongside engineering leads and architects to influence secure design and implementation.
• Lead practical threat modeling, helping teams understand where risk lives and turning that insight into actionable engineering decisions.
• Go beyond automated findings with hands-on code review, design review, and security testing that identifies the issues requiring real human judgment.
• Own the vulnerability lifecycle, evaluating findings from static/dynamic scans and secret-detection tools and helping teams prioritize what matters.
• Make security tooling better, tuning and maintaining security tooling within delivery pipelines and bringing security insights into developer workflows.
• Build for the AI era, creating agentic tooling that improves vulnerability triage and remediation guidance with human oversight.
• Help secure AI-assisted development by shaping guardrails for AI-assisted and agent-generated code and validating controls.
• Turn identified vulnerabilities into resolved vulnerabilities by reproducing issues, shaping remediation, and validating fixes.
• Represent security in architectural decisions, clearly explaining risk, tradeoffs, and practical paths forward.
• Raise security capability around you by mentoring engineers and security champions.

Conoscenze

Application security

Threat modeling

Code review

Vulnerability management

Security tooling

AI security

Architectural decisions

Mentoring

AWS

Kubernetes

Containers

IaC

LLM/Agents security

Descrizione del lavoro

Senior Application Security Engineer | United States | Remote

Pax8 is hiring a Senior Application Security Engineer in the United States to help secure the cloud marketplace, financial platforms, and agentic AI products powering our next chapter.

This is application security with real ownership. You'll partner directly with engineering leaders and architects, influence how products are designed and delivered, and combine deep security craft with emerging AI capabilities. The fundamentals matter here: AI is a force multiplier, but great security judgment comes first.

Build what's next, securely

Pax8 is evolving quickly, and our Platform Security team is growing alongside our product landscape. You'll join a small, collaborative remote team where you're trusted to take ownership, work independently, and bring security into engineering conversations early.

We're building at the intersection of cloud, security, automation, and AI. Get to know more about Pax8 and explore our latest developments in the Pax8 US Newsroom.

What you'll get ownership of

• Be a trusted security partner to your product area, working alongside engineering leads and architects to influence secure design and implementation.
• Lead practical threat modeling , helping teams understand where risk lives and turning that insight into actionable engineering decisions.
• Go beyond automated findings with hands-on code review, design review, and security testing that identifies the issues requiring real human judgment.
• Own the vulnerability lifecycle , evaluating findings from static application security testing, software composition analysis, dynamic application security testing, and secret-scanning tools and helping teams prioritize what genuinely matters.
• Make security tooling better , tuning and maintaining security tooling within delivery pipelines and bringing useful security insight directly into developer workflows.
• Build for the AI era , creating agentic tooling that can improve vulnerability triage, deduplication, exploitation enrichment, and remediation guidance while maintaining appropriate human oversight.
• Help secure AI-assisted development , shaping guardrails for AI-assisted and agent-generated code and validating whether those controls work in practice.
• Turn identified vulnerabilities into resolved vulnerabilities , partnering with engineering teams to reproduce issues, shape remediation, and validate fixes.
• Represent security in architectural decisions , clearly explaining technical risk, tradeoffs, and practical paths forward.
• Raise security capability around you - mentoring you and engineering security champions while turning recurring ...

The impact you'll make

You'll help bring security closer to the engineering teams building Pax8's next generation of products. Your work will make application security more scalable, measurable, and useful to developers while helping the business innovate confidently across established cloud products, new financial technology, and emerging agentic AI capabilities.

You won't simply point out risk. You'll help engineering teams understand it, solve it, and build more securely the next time.

You'll thrive here if you bring

• Substantial application or product security experience , with a track record of partnering directly with software engineering teams.
• Deep practical capability in threat modeling and manual code review for web and microservice environments.
• Strong understanding of difficult application-security problems such as authorization, multi-tenant isolation, and business-logic vulnerabilities .
• Hands-on experience operating application security tooling for source-code analysis, dependency analysis, dynamic testing, and secret detection , including configuration, tuning, pipeline integration, and finding triage.
• The technical judgment to distinguish a noisy security finding from an exploitable risk and explain the remediation clearly.
• Experience creating automation or engineering tooling for vulnerability management . Applying large language models or agents to security workflows is especially valuable.
• Practical understanding of security risks in large language model and agentic applications , including prompt injection, unauthorized tool use, and potential data-exfiltration paths.
• Proficiency with at least one modern cloud-native programming language. Our environment includes Kotlin and JavaScript/TypeScript , and you should be comfortable reading unfamiliar code.
• Working knowledge of Amazon Web Services, Kubernetes, containers, and infrastructure as code .
• Bonus depth in securing agentic applications, Model Context Protocol integrations, identity and authorization in multi-tenant software-as-a-service environments, or transactional and financial systems.
• The confidence to challenge a design constructively,