Staff Application Security Engineer

Ironclad Inc.; San Francisco (CA); On-site; USD 170,000 - 190,000; Full time

Benefits offered by this job

100% health coverage for employees

Market-leading leave policies

Paid time off

401(k) plan with employer match

Job summary

A leading software company in San Francisco is looking for an Application Security Engineer. This hybrid role requires strong experience in automated vulnerability scanning and penetration testing. Responsibilities include developing secure coding practices, conducting security assessments, and collaborating with various teams. Ideal candidates will have experience in software development at SaaS companies and an understanding of application security practices. Competitive salary and benefits package included.

Qualifications

• 3+ years of experience in application security or software development.
• In-depth knowledge of OWASP Top 10 and SANS Top 25.
• Experience operating in any cloud provider is preferred.

Responsibilities

• Develop and implement secure coding practices and standards.
• Conduct application security assessments to identify and mitigate risks.
• Work closely with cross-functional teams to remediate software vulnerabilities.

Skills

Application security concepts and practices

Strong proficiency in Typescript or Javascript

Experience with security testing tools

Cloud provider experience (AWS, GCP, etc.)

Excellent communication, analytical and problem-solving skills

Team-oriented

Education

BA/BS/MS in Computer Science or related field

Tools

Burp Suite

AppScan

Nessus

Job description

This is a hybrid role. Office attendance is required at least twice a week on Tuesdays and Thursdays for collaboration and connection. There may be additional in-office days for team or company events.

Application Security Engineer with a passion for securing modern software platforms and protecting sensitive data. We are looking for someone with strong experience in automated vulnerability scanning and penetration testing to strengthen our application security program. The ideal candidate will have experience in software development or testing at SaaS companies or in regulated fields.

This role will be responsible for conducting security assessments, identifying and mitigating risks, and implementing security best practices and process improvements across Ironclad’s Product, Platform and Engineering teams.

Roles & Responsibilities

• Develop and implement secure coding practices, procedures, and standards for software development teams.
• Conduct application security assessments and vulnerability testing to identify and mitigate risks.
• Perform security reviews of code changes and ensure that security issues are addressed.
• Collaborate with cross-functional teams to remediate software vulnerabilities and implement secure coding practices.
• Integrate security review processes into Ironclad’s CI/CD pipeline.
• Conduct threat modeling and risk analysis to protect sensitive data.
• Provide domain expertise on protective controls including system, network, encryption, and authentication services.
• Work closely with members of the SRE, Development, IT, and Security teams to drive impactful changes to Ironclad’s cybersecurity posture.
• Work closely with the risk and governance teams to implement compliance and security requirements.
• Contribute to secure coding and other cybersecurity training programs.
• Stay up-to-date with the latest security trends, vulnerabilities, and attack techniques.
• Provide technical leadership and mentorship to other members of the engineering and security teams.

Key Skills

• BA/BS/MS in Computer Science or related field or equivalent experience.
• 3+ Years of experience working in application security or software development, preferably with SaaS companies or in regulated fields.
• In-depth knowledge of application security concepts and practices, including OWASP Top 10 and SANS Top 25.
• Experience with security testing tools such as Burp Suite, AppScan, and Nessus.
• Strong proficiency in either Typescript or Javascript.
• Experience operating in any cloud provider (AWS, GCP, Azure, Digital Ocean etc.).
• Ability to appropriately prioritize and respond to different escalations.
• Experience working collaboratively with cross-functional teams.
• Strong desire to take ownership of problems.
• Comfort working in a rapidly evolving environment and dealing with ambiguity.
• Excellent communication, analytical and problem-solving skills.
• Team and goal-oriented.
• High output, low ego.

Nice to Have

• AI penetration testing.
• Experience with git and software branching and workflow strategies.
• Experience working with modern, microservice architectures including in Kubernetes or other containerized environments.
• Experience with enterprise observability platforms such as ELK, Datadog, Prometheus, Grafana, etc.
• Knowledge of Terraform or other infrastructure-as-code and configuration management solutions.
• Experience with SOC 2, ISO 27001, NIST, and CIS standards and frameworks.
• Experience with SAST and SCA tools such as Snyk, Checkmarx, Veracode, WhiteSource, or Black Duck.

Base Salary Range: $170,000 - $190,000

The base salary range represents the minimum and maximum of the salary range for this position based at our San Francisco headquarters. The actual base salary offered for this position will depend on numerous factors, including individual proficiency, anticipated performance, and the location of the selected candidate. Our base salary is just one component of Ironclad’s competitive total rewards package, which also includes equity awards (a new hire grant, along with opportunities for additional awards throughout your tenure), competitive health and wellness benefits, and a commitment to career growth and development.

US Full-Time Employee Benefits at Ironclad

• 100% health coverage for employees (medical, dental, and vision), and 75% coverage for dependents with buy-up plan options available
• Market-leading leave policies, including gender-neutral parental leave and compassionate leave
• Family forming support through Maven for you and your partner
• Paid time off - take the time you need, when you need it
• Monthly stipends for wellbeing, hybrid work, and (if applicable) cell phone use
• Mental health support through Modern Health, including therapy, coaching, and digital tools
• Pre-tax commuter benefits (US Employees)
• 401(k) plan with Fidelity with employer match (US Employees)
• Regular team events to connect, recharge, and have fun
• And most importantly: the opportunity to help build the company you want to work at

UK Employee-specific benefits are included on our UK job postings

Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.