Staff AppSec Engineer: AI-Driven Secure SDLC Lead

Sierra Ventures; United States; Hybrid; USD 168,000 - 240,000; Full time

Benefits offered by this job

Competitive starting pay

Discretionary annual bonus

Equity grant

Healthcare plans

401K with company matching

Paid Parental Leave

Flexible time off

Job summary

Gemini in the United States is seeking a Staff Application Security Engineer to own the technical strategy securing on‑chain, exchange, and payment surfaces. You will partner with senior engineering leadership and design AI agents that secure Gemini’s SDLC at scale.

You will lead threat modeling, code reviews, and penetration testing, build security training for engineers, and participate in on‑call rotations to harden systems.

Qualifications

• Proven ability to perform design reviews and threat modeling, secure code reviews, and penetration testing.
• Strong background in application security best practices and familiarity with common vulnerabilities (e.g. SSRF, race conditions, privilege escalations).
• Deep code review proficiency in Scala, Java, Go or other common languages; hands-on Python or Go experience.
• Experience implementing custom detection and prevention AppSec controls beyond OWASP Top 10.
• Familiarity with regulated environments (fintech/crypto) and ability to align security with business goals.
• Strong cross-functional communication and collaboration.
• Typically 7-10+ years of experience in application security or related roles.

Responsibilities

• Own and evolve the Secure SDLC guardrails as an AppSec SME.
• Lead architecture reviews, threat modeling, code reviews, and pen tests for high-risk apps.
• Design and build AI agents for automated threat modeling and secure coding.
• Create and deliver hands-on application security training at scale.
• Participate in on-call rotations and lead post-incident hardening.

Skills

Threat modeling

Code reviews

Penetration testing

AI tooling

Security training

Cross-functional collaboration

Tools

SLSA

OWASP SPVS

CI/CD security

Job description

Gemini in the United States is seeking a Staff Application Security Engineer to own the technical strategy securing on‑chain, exchange, and payment surfaces. You will partner with senior engineering leadership and design AI agents that secure Gemini’s SDLC at scale.

You will lead threat modeling, code reviews, and penetration testing, build security training for engineers, and participate in on‑call rotations to harden systems.