Sr. Application Security Engineer

Pax8, Inc; United States; Presencial; USD 140.000 - 160.000; Tempo integral

Benefícios oferecidos por esta vaga

401(k) with Company Match

Medical, Dental & Vision Coverage

Employee Assistance Program (EAP)

Employer-Paid Life, AD&D, Short-Term &

Resumo da vaga

Pax8 is seeking an experienced security leader to partner with product engineering, perform threat modeling, and own the vulnerability lifecycle across modern application stacks.

You will drive secure design from architecture through delivery, combining automated findings with hands-on review and testing to protect Pax8’s cloud products and AI-enabled capabilities.

Qualificações

• Substantial application or product security experience with engineering teams.
• Deep threat modeling and manual code review for web/microservice environments.
• Strong understanding of authorization, multi-tenant isolation and business-logic issues.
• Hands-on tooling for source-code analysis, dependency analysis, dynamic testing, and secret detection.
• Ability to distinguish between noisy findings and real risk with clear remediation guidance.
• Experience creating automation tooling for vulnerability management.
• Applying LLMs or agents to security workflows is valuable.
• Proficiency in Kotlin and JavaScript/TypeScript; comfortable with AWS, Kubernetes, containers and IaC.

Responsabilidades

• Be a trusted security partner to product teams, influencing secure design and implementation.
• Lead practical threat modeling and translate risk into engineering actions.
• Do hands-on code/design review and security testing beyond automated findings.
• Own vulnerability lifecycle across SAST, SCA, DAST, and secret scanning.
• Tune and maintain security tooling within delivery pipelines and dev workflows.
• Build agentic tooling for vulnerability triage and remediation guidance.
• Help secure AI-assisted development with guardrails and validation.
• Turn vulnerabilities into fixes through reproduction, remediation, and verification.
• Represent security in architectural decisions, explaining risks and tradeoffs.
• Mentor teammates and scale security capabilities across teams.
• Support penetration testing findings, bug bounty triage, and security incidents when needed.

Conhecimentos

Application security

Threat modeling

Manual code review

Authorization

Multi-tenant isolation

Business logic

Source-code analysis

Dependency analysis

Dynamic testing

Secret detection

CI/CD integration

Automation tooling

LLMs in security

Kotlin

JavaScript/TypeScript

AWS

Kubernetes

Containers

Infrastructure as code

Agentic security

Model Context Protocol

Ferramentas

Kotlin

JavaScript/TypeScript

AWS

Kubernetes

Containers

Infrastructure as code

Descrição da vaga

What you’ll get ownership of

• Be a trusted security partner to your product area, working alongside engineering leads and architects to influence secure design and implementation.


• Lead practical threat modeling, helping teams understand where risk lives and turning that insight into actionable engineering decisions.


• Go beyond automated findings with hands‑on code review, design review, and security testing that identifies the issues requiring real human judgment.


• Own the vulnerability lifecycle, evaluating findings from static application security testing, software composition analysis, dynamic application security testing, and secret‑scanning tools and helping teams prioritize what genuinely matters.


• Make security tooling better, tuning and maintaining security tooling within delivery pipelines and bringing useful security insight directly into developer workflows.


• Build for the AI era, creating agentic tooling that can improve vulnerability triage, deduplication, exploitability enrichment, and remediation guidance while maintaining appropriate human oversight.


• Help secure AI‑assisted development, shaping guardrails for AI‑assisted and agent‑generated code and validating whether those controls work in practice.


• Turn identified vulnerabilities into resolved vulnerabilities, partnering with engineering teams to reproduce issues, shape remediation, and validate fixes.


• Represent security in architectural decisions, clearly explaining technical risk, tradeoffs, and practical paths forward.


• Raise security capability around you, mentoring teammates and engineering security champions while turning recurring defects into focused learning.


• Support penetration‑testing findings, bug bounty triage, and security incidents when your application security expertise is needed.

The impact you’ll make

• You’ll help bring security closer to the engineering teams building Pax8’s next generation of products.


• Your work will make application security more scalable, measurable, and useful to developers while helping the business innovate confidently across established cloud products, new financial technology, and emerging agentic AI capabilities.


• You won’t simply point out risk. You’ll help engineering teams understand it, solve it, and build more securely the next time.

You’ll thrive here if you bring

• Substantial application or product security experience, with a track record of partnering directly with software engineering teams.


• Deep practical capability in threat modeling and manual code review for web and microservice environments.


• Strong understanding of difficult application‑security problems such as authorization, multi‑tenant isolation, and business‑logic vulnerabilities.


• Hands‑on experience operating application security tooling for source‑code analysis, dependency analysis, dynamic testing, and secret detection, including configuration, tuning, pipeline integration, and finding triage.


• The technical judgment to distinguish a noisy security finding from an exploitable risk and explain the remediation clearly.


• Experience creating automation or engineering tooling for vulnerability management.


• Applying large language models or agents to security workflows is especially valuable.


• Practical understanding of security risks in large language model and agentic applications, including prompt injection, unauthorized tool use, and potential data‑exfiltration paths.


• Proficiency with at least one modern cloud‑native programming language. Our environment includes Kotlin and JavaScript/TypeScript, and you should be comfortable reading unfamiliar code.


• Working knowledge of Amazon Web Services, Kubernetes, containers, and infrastructure as code.


• Bonus depth in securing agentic applications, Model Context Protocol integrations, identity and authorization in multi‑tenant SaaS environments, or transactional and financial systems.


• The confidence to challenge a design constructively, explain the tradeoff, and work with engineers toward a solution rather than simply raising a blocker.

Trust starts with how we hire

At Pax8, we care deeply about building genuine, trust based relationships — starting with how we hire. To protect our business, our teams, and our customers, we use a range of measures throughout the recruitment process to help confirm authenticity and prevent fraud. These safeguards are designed to be fair, respectful, and proportionate, and may evolve as risks change. By applying, you acknowledge that we take steps to verify identity and representation during hiring. If you're applying as your authentic self, you have nothing to worry about — we're excited to meet you. We also use thoughtfully applied AI‑enabled tools to support our hiring process. These tools may assist with tasks such as reviewing or prioritising applications, but hiring decisions are made by our people. More information is available in our Recruitment Privacy Notice. If you have questions about how we hire or would prefer not to have your application supported by these tools, you can opt out at any part of our process.

Bring your perspective

We encourage you to apply even if you don't meet 100% of the criteria. We're committed to diverse perspectives, inclusive hiring and sharing your transferrable skills. To fulfil this role, you must hold valid right to work in United States.

Compensation & benefits

Compensation Range: $140,000 - $160,000

Application Deadline: November 30, 2026

• 401(k) with Company Match


• Medical, Dental & Vision Coverage


• Employee Assistance Program (EAP)


• Employer-Paid Life, AD&D, Short-Term Disability & Long-Term Disability Insurance


• Flexible Open PTO


• Paid Sick Leave


• Paid Parental Leave


• RTD EcoPass (eligible Colorado-based employees)

What’s in it for you?

• There’s extensive room for a talented individual to grow at pace — whether that’s advancing quickly in this role or exploring one of the many opportunities across our global organisation.


• You’ll have access to our internal development hub designed to accelerate your skills and stretch your potential.


• Alongside specialist Learning & Development trainers, you’ll also tap into AI powered tools, \"born in the cloud\" mentors, and cross continent collaboration that broaden your perspective and sharpen your expertise.


• We’ll give you the space, trust, and the right projects to help you thrive — and full visibility of what it takes to reach your next level.

Why Pax8?

Our mission is to build the managed intelligence marketplace and empower small businesses to do more with smarter technology.

We are a fast‑growing, dynamic, and high‑energy organisation with a start‑up feel, allowing you to make a meaningful impact on the business.

Culture is also important to us, and at Pax8, it’s business, and it IS personal. We are passionate, creative, and unconventional.

We work hard, keep it fun, and expect the best! We Elev8 each other. We Advoc8 for our partners. We Innov8 continuously. We Celebr8 life.

Background checks

As part of our hiring process, we are required to undertake pre‑employment checks on all candidates that are successful in their application with Pax8. As part of these checks Pax8 will request ID verification, reference requests and qualification checks (additional checks may be completed for certain countries, such as criminal and financial). All checks are completed by our third‑party provider, First Advantage. Once checks have been completed all candidates will receive a copy for their records.

Equal opportunities

Pax8 are an equal opportunities employer and welcome individuals who are in possession of the appropriate requirements to work within the country you have applied for. Offered individuals will be asked to undertake identity, security compliance and reference checks. Your privacy is important to us. Your data will be held in accordance with local best practices and processed only in accordance with our recruiting processes. Privacy notice: https://www.pax8.com/en-us/terms/job-applicant-privacy-notice/ At Pax8, we care deeply about building genuine, trust‑based relationships — starting with how we hire. To protect our business, our teams, and our customers, we use a range of measures throughout the recruitment process to help confirm authenticity and prevent fraud. These safeguards are designed to be fair, respectful, and proportionate, and may evolve as risks change. By applying, you acknowledge that we take steps to verify identity and representation during hiring. If you’re applying as your authentic self, you have nothing to worry about — we’re excited to meet you.

Perks

• At Pax8 we believe that your Total Rewards should include a benefits package that shows how much we value our greatest assets.


• All FTE Pax8 people enjoy the following benefits:


• 401(k) with Company Match


• Medical, Dental & Vision Coverage


• Employee Assistance Program (EAP)


• Employer-Paid Life, AD&D, Short-Term Disability & Long-Term Disability Insurance


• Flexible Open PTO


• Paid Sick Leave


• Paid Parental Leave


• RTD EcoPass (eligible Colorado-based employees)

Job Applicant Privacy Notice

Pax8 is the global AI and cloud Marketplace for small and medium‑sized businesses (SMBs). Pax8 connects service providers and technology companies on a unified platform to discover, buy, sell, deploy and manage technology solutions for SMBs. More than 47,000 IT partners and 800,000 SMBs rely on Pax8 for expertise, automation and real‑time insights to stay productive, protected and prepared for the AI economy. Learn more at pax8.com. Our purpose is to help every small business turn their dreams into reality through the power of technology. Culture is important to us, and at Pax8, its business, and it IS personal. We embody Compassionate Candour by aiming to assist others with candid, actionable feedback. We Seek to Understand by being open, curious, and committed to learning. We believe in We Before Me, actively collaborating and seeking out diverse perspectives to ensure a win for Team Pax8. Our team takes pride in Do What You Say, taking ownership, honoring commitments, prioritizing, and delivering on promises. We encourage everyone to Light Up Learning by being brave and trying new ideas, embracing vulnerability, and sharing failures so everyone can learn. Finally, we are Driven by Passion, connecting personal passion to Pax8's mission, and remaining resilient in the face of adversity and uncertainty in pursuit of our goals. At Pax8, we are passionate, creative, and humorously off‑beat. We work hard, keep it fun, and expect the best!