Sr. Software Engineer - Application Security

Backblaze; United States; Remote; USD 150,000 - 210,000; Full time

Benefits offered by this job

Remote-first culture

Competitive compensation and benefits

Job summary

Backblaze, a large-scale cloud storage and backup platform, seeks a senior, hands-on application security professional embedded directly in product engineering. The role emphasizes building security into how the product is used, how customer data is stored, and how new features are delivered, with active use of AI tools across development and security tasks.

Responsibilities include designing security features for a distributed web stack, conducting security assessments and code reviews, and

Qualifications

• Hands-on security experience embedded in product engineering.
• Active use of AI tools for both coding and security tasks.
• Strong understanding of OWASP Top 10 vulnerabilities and experience with security testing tools.
• Familiarity with web technologies (HTTP, REST APIs) and cloud environments.

Responsibilities

• Design, build, and maintain software security features across a large, distributed web stack, using AI-assisted development to accelerate and harden the work.
• Perform security assessments and code reviews on internal and customer-facing applications, and partner with engineers to remediate vulnerabilities using AI tools.
• Develop security automation and internal tooling to streamline detection, review, and remediation workflows.
• Operate and support the bug bounty program, including triaging newly reported vulnerabilities, determining remediation paths, and guiding engineering teams on fixes.
• Apply and extend knowledge of cryptography and secure authentication across the platform, and design new components as security needs evolve.
• Investigate emerging vulnerabilities in existing applications, recommend practical remediations, and contribute security expertise to feature design discussions.

Skills

AI-assisted coding

Application development

OWASP Top 10

Programming languages

Tools

SAST/DAST tools

Fuzzing tools

Vulnerability scanners

Cloud/web security tooling

Job description

Role overview

A senior, hands-on application security role embedded directly in product engineering for a large-scale cloud storage and backup platform. The focus is on building security into how the product is used, how customer data is stored, and how new features are delivered, while actively leveraging AI tools across both development and security work.

Responsibilities

• Design, build, and maintain software security features across a large, distributed web stack, using AI-assisted development to accelerate and harden the work.
• Perform security assessments and code reviews on internal and customer-facing applications, and partner with engineers to remediate vulnerabilities using AI tools.
• Develop security automation and internal tooling to streamline detection, review, and remediation workflows.
• Operate and support the bug bounty program, including triaging newly reported vulnerabilities, determining remediation paths, and guiding engineering teams on fixes.
• Apply and extend knowledge of cryptography and secure authentication across the platform, and design new components as security needs evolve.
• Investigate emerging vulnerabilities in existing applications, recommend practical remediations, and contribute security expertise to feature design discussions.

Requirements

• Solid application development background combined with hands-on application security experience, and active use of AI tools for both coding and security tasks.
• Strong understanding of OWASP Top 10 vulnerabilities and experience with security testing tools such as SAST and DAST scanners, fuzzing tools, and vulnerability scanners.
• Familiarity with web technologies including HTTP and REST APIs, and experience working with web applications, cloud systems, and Linux environments.
• Working knowledge of cryptography and secure authentication patterns, plus an understanding of how cloud environments and their native security features are applied.
• Programming experience in languages such as Java, JSP, JavaScript, TypeScript, Go, Python, and C/C++, and comfort working across a large codebase running on many servers (for example, Apache Tomcat and Node-based services).
• Ability to learn unfamiliar technologies or implementations as needed and apply AI coding tools (such as Gemini, Claude Code, ChatGPT, Cursor, or comparable) to real development and security work.

Benefits and work setup

• Remote-first culture with a focus on work-life balance and collaboration with experienced engineering, security, product, and QA teams.
• Opportunity to work at the intersection of AI, data protection, and cloud storage, building security features used by customers worldwide.
• Competitive compensation and benefits package.