Staff Application Security Engineer

Hampton North; United States; Remote; USD 190,000 - 270,000; Full time

Job summary

Hampton North is seeking a Staff/Principal Application Security Engineer to own security across a PII/PHI-heavy platform. You’ll live in the codebase, building runtime and database security controls and leveraging frontier AI tooling to fix bugs at scale.

report to the CTO, collaborate with a small senior security team, and pursue a path toward a hands-on CISO seat.

Qualifications

• Staff or principal AppSec experience at a product company.
• Currently writing production code in any language; Ruby, Python or Java a plus.
• Track record of security controls at application runtime or database layer.
• Strong full-stack, cloud and scalable architecture background.
• Deep web app security knowledge across OWASP Top 10 classes.
• Fluency with AI-assisted security tooling and frontier models.
• Ability to explain risk and tradeoffs to engineers and leadership.
• Plus: offensive security consulting or GovTech/FedRAMP experience.

Responsibilities

• Build and ship enterprise-grade security controls in the application runtime and database layer, including row-level data encryption.
• Find and fix vulnerabilities at scale through code audits, threat modeling, penetration testing and agentic AI pipelines.
• Set secure coding standards and security direction across the SDLC, the product and the cloud environment.
• Partner with the platform team on IAM and the permissions framework, layering application controls on top.
• Lead AppSec incident response with on-call engineers and write the post-incident analyses.
• Stand up a pre-launch security review process, a vendor-run bug bounty and intake for security researcher reports.
• Secure file upload and download flows and harden PII and PHI handling.
• Integrate application logging and alerting with the SIEM.
• Support SOC 2 Type II, HIPAA and FedRAMP controls and evidence collection.
• Mentor developers, shape security hiring plans and represent security to leadership.

Skills

Staff or principal AppSec experience

Production coding experience

Security controls at runtime/db layer

Full-stack/cloud architecture

OWASP Top 10 knowledge

AI-assisted security tooling

Risk communication to stakeholders

GovTech/HIPAA/FedRAMP experience

Job description

Staff/Principal Application Security Engineer

A mission-driven Series B SaaS company is hiring a Staff/Principal Application Security Engineer to own application security across a platform that holds highly sensitive PII and PHI for public sector agencies. You'll live in the codebase, building security controls at the application runtime and database layer and using frontier AI tooling to find and fix bugs at scale. You'll report to the CTO, work alongside a small senior security team, and have a path toward a hands-on CISO seat.

Logistics:

Remote

Here's what you'll be doing:

• Build and ship enterprise-grade security controls in the application runtime and database layer, including row-level data encryption
• Find and fix vulnerabilities at scale through code audits, threat modeling, penetration testing and agentic AI pipelines
• Set secure coding standards and security direction across the SDLC, the product and the cloud environment
• Partner with the platform team on IAM and the permissions framework, layering application controls on top
• Lead AppSec incident response with on-call engineers and write the post-incident analyses
• Stand up a pre-launch security review process, a vendor-run bug bounty and intake for security researcher reports
• Secure file upload and download flows and harden PII and PHI handling
• Integrate application logging and alerting with the SIEM
• Support SOC 2 Type II, HIPAA and FedRAMP controls and evidence collection
• Mentor developers, shape security hiring plans and represent security to leadership

And what you need to have:

• Staff or principal level AppSec or product security experience at a product company
• Currently writing production code and comfortable in any language; Ruby, Python or Java a plus
• A track record of security controls you built at the application runtime or database layer
• Strong full-stack, cloud and scalable architecture background
• Deep web application security knowledge across OWASP Top 10 vulnerability classes
• Fluency with AI-assisted security tooling and frontier models
• The ability to explain risk and tradeoffs to engineers, executives and non-technical stakeholders
• Plus: offensive security consulting, fintech, healthtech or HIPAA, GovTech or FedRAMP