Staff Security Engineer, Application Security

Jobtailor; California (MO); On-site; USD 140,000 - 190,000; Full time

Job summary

Jobtailor is seeking an experienced security engineer to own and advance key security domains across the product lifecycle.

You will partner with engineering teams to embed security into design reviews, threat modeling, and CI/CD pipelines, while driving vulnerability management and secure automation initiatives.

Qualifications

• 7+ years of experience in Application Security, Product Security, or Security Engineering.
• Strong hands-on experience with threat modeling and secure design.
• Experience with vulnerability management and application security tooling.
• Experience working in cloud-native environments such as AWS and GCP.
• Experience integrating security into CI/CD pipelines and developer workflows.
• Ability to write code in Python, Go, or similar languages for automation and tooling.
• Strong ability to work cross-functionally with engineering teams.

Responsibilities

• Own key security domains such as vulnerability management, application security, API security, and supply chain security.
• Drive improvements in security coverage, prioritization, and remediation workflows.
• Partner with engineering teams to integrate security into design reviews, threat modeling, CI/CD pipelines, and developer workflows.
• Provide actionable, pragmatic guidance that helps teams ship securely.
• Develop and improve security tooling and automation to reduce manual effort.
• Implement and tune tools for SAST, SCA, DAST, dependency security, and container security.
• Leverage AI/LLMs where appropriate to improve triage, detection, and review processes.
• Triage and prioritize vulnerabilities using risk-based approaches.
• Partner with teams to ensure timely remediation of critical issues.
• Help define and improve SLAs, metrics, and reporting.
• Conduct threat modeling, design reviews, and security assessments.
• Contribute to incident response and postmortems for security events.
• Identify and help remediate systemic risks.

Skills

Vulnerability Management

Application Security Tooling

Threat Modeling

Secure Design

Automation in Python

Automation in Go

Security Assessments

Incident Response

Risk-Based Approaches

Security Metrics

Tools

AWS

GCP

Job description

Responsibilities

• Own key security domains such as vulnerability management, application security, API security, and supply chain security
• Drive improvements in security coverage, prioritization, and remediation workflows
• Partner with engineering teams to integrate security into design reviews, threat modeling, CI/CD pipelines, and developer workflows
• Provide actionable, pragmatic guidance that helps teams ship securely
• Develop and improve security tooling and automation to reduce manual effort
• Implement and tune tools for SAST, SCA, DAST, dependency security, and container security
• Leverage AI/LLMs where appropriate to improve triage, detection, and review processes
• Triage and prioritize vulnerabilities using risk‑based approaches
• Partner with teams to ensure timely remediation of critical issues
• Help define and improve SLAs, metrics, and reporting
• Conduct threat modeling, design reviews, and security assessments
• Contribute to incident response and postmortems for security events
• Identify and help remediate systemic risks

Requirements

• 7+ years of experience in Application Security, Product Security, or Security Engineering
• Strong hands‑on experience with threat modeling and secure design
• Experience with vulnerability management and application security tooling
• Experience working in cloud‑native environments such as AWS and GCP
• Experience integrating security into CI/CD pipelines and developer workflows
• Ability to write code in Python, Go, or similar languages for automation and tooling
• Strong ability to work cross‑functionally with engineering teams

Hard Skills

• Vulnerability Management
• Application Security Tooling
• Threat Modeling
• Secure Design
• Automation in Python
• Automation in Go
• Security Assessments
• Incident Response
• Risk‑Based Approaches
• Security Metrics

Soft Skills

• Cross‑Functional Collaboration
• Pragmatic Guidance