Staff Application Security Engineer — SDLC Champion

Remote; San Francisco (CA); In loco; USD 180.000 - 280.000; Tempo pieno

Descrizione del lavoro

Shield AI seeks a Staff Application Security Engineer to build and advance a scalable, developer-centered application security program. You will establish company-wide secure SDLC policy and standards, turn them into practical engineering practices, and partner with product, platform, and development teams to improve secure development and software supply-chain maturity.

This staff-level IC role will influence engineering, security, product, and technology leadership, driving secure development

Competenze

• 7+ years of experience in application security, product security, DevSecOps, secure software engineering, or a closely related field.
• Demonstrated experience designing, implementing, or maturing a secure SDLC or application-security program across multiple engineering teams.
• Strong working knowledge of secure coding practices, application-security testing, vulnerability management, software delivery, and DevSecOps principles.
• Experience working directly with developers to explain findings, guide remediation, and improve secure-development practices.
• Hands‑on experience with SAST, DAST, SCA, dependency vulnerability management, secrets scanning, and related application-security tooling.
• Experience integrating security controls into source-control, CI/CD, build, release, and deployment workflows.
• Experience performing or facilitating threat modeling, security design review, architecture review, or security requirements definition.
• Knowledge of common application-security risks, including authentication, authorization, API security, insecure deserialization, injection vulnerabilities, insecure dependency use, secrets exposure, and business-logic vulnerabilities.
• Experience with software supply-chain security concepts, including SBOMs, dependency provenance, build integrity, artifact signing, release attestations, and secure artifact management.
• Experience with open-source software risk management, including vulnerable dependencies, transitive dependencies, license obligations, and governance processes.
• Familiarity with NIST SP 800-218 / SSDF, OWASP SAMM, SLSA, or comparable secure-development and supply-chain security frameworks.
• Ability to read and assess production code and scripts in one or more modern programming languages.
• Strong written and verbal communication skills, including the ability to explain technical risk and tradeoffs to developers, leaders, auditors, and nontechnical stakeholders.

Mansioni

• Establish, maintain, and improve company-wide secure SDLC policies, standards, control objectives, procedures, and evidence requirements.
• Translate policy into clear, achievable requirements for development, product, and platform teams.
• Assess maturity of development teams, CI/CD pipelines, source-control practices, build environments, and release processes; define improvement roadmaps.
• Develop secure-development guidance, reference architectures, reusable patterns, guardrails, and developer enablement materials.
• Partner with development teams to identify, triage, remediate, and verify application-security findings.
• Evaluate, implement, tune, and operationalize application-security tooling (SAST, DAST, SCA, secrets, IaC, container, API security).
• Ensure tooling yields actionable findings with limited false positives.
• Lead threat modeling, security requirements definition, and secure design reviews for high-risk applications.
• Establish risk-based vulnerability management processes with SLAs and compensating controls.
• Develop processes for identifying and remediating vulnerable third-party/open-source dependencies.
• Establish open-source governance, including inventory, license reviews, and policy enforcement.
• Mature software supply-chain security practices (SBOMs, VEX, build provenance, signing, verification).
• Partner with DevOps to secure CI/CD pipelines with least privilege, protected branches, and secret handling.
• Set requirements for secure repositories, build systems, and deployment pipelines.
• Support vulnerability intake, coordinated disclosure, advisories, CVE triage, and incident response.
• Create security champions program with guidance, training, and engagement pathways.
• Develop executive-ready metrics on secure-SDLC adoption, AppSec risk, remediation, and program maturity.

Conoscenze

Application security

Secure SDLC

DevSecOps

Threat modeling

Security requirements

Communication skills

Cross-functional partnership

Strumenti

SAST

DAST

SCA

Secrets scanning

IaC security scanning

Container security

API security controls

SBOMs

VEX

Build provenance

Descrizione del lavoro

Shield AI seeks a Staff Application Security Engineer to build and advance a scalable, developer-centered application security program. You will establish company-wide secure SDLC policy and standards, turn them into practical engineering practices, and partner with product, platform, and development teams to improve secure development and software supply-chain maturity.

This staff-level IC role will influence engineering, security, product, and technology leadership, driving secure development