Staff Security Engineer - Applications

Vero; United States; Remote; USD 230,000 - 270,000; Full time

Benefits offered by this job

Remote work (US)

Job summary

Vero is seeking a Principal Application Security Engineer to own security across a large AWS-based SaaS platform. You will lead secure SDLC, drive automation, and embed security into product design and release processes.

You will design scalable AppSec capabilities, perform hands-on pentesting, and collaborate with Product, Engineering, and leadership to raise security maturity in a cloud-first environment.

Qualifications

• Strong background in application security, product security, offensive security, or security engineering, ideally at Staff or Principal level.
• Experience owning or leading an application security programme within SaaS or cloud-first environments.
• Hands-on penetration testing across web apps, REST/GraphQL APIs, and cloud infrastructure.
• Experience building and integrating AppSec tooling into CI/CD, including SAST, DAST, SCA, secrets detection, and container security.
• Experience designing secure SDLC processes, release gates, and developer security standards.
• Strong understanding of threat modelling, secure architecture, OWASP vulnerabilities, and best practices.
• Hands-on experience with AWS, Kubernetes/EKS, IAM, and cloud-native architectures.
• Experience securing AI-enabled applications or implementing security guardrails for AI development.
• Familiarity with HIPAA, SOC 2, HITRUST, ISO 27001.
• Strong communication skills to influence engineering teams and senior stakeholders.

Responsibilities

• Own and evolve end-to-end application security programme across AWS-based SaaS platform.
• Lead secure SDLC initiatives, embedding security into product architecture, engineering workflows, and release processes.
• Build and optimise automated AppSec capabilities across CI/CD pipelines, including SAST, SCA, secrets detection, container scanning, and IaC security.
• Drive threat modelling, secure architecture reviews, and vulnerability management across products, APIs, and cloud infrastructure.
• Design and implement security release gates, launch readiness checklists, and developer guardrails to prevent vulnerabilities reaching production.
• Conduct hands-on penetration testing across web applications, APIs, cloud environments, and multi-tenant architectures.
• Establish security controls for AI-assisted development and agentic AI features, including prompt injection, data leakage, and tool abuse risks.
• Own external penetration testing programmes, coordinating testing, remediation, and validation of findings.
• Partner closely with Product, Engineering, DevSecOps, and leadership teams to improve security maturity and establish scalable secure development practices.

Skills

Application security

SaaS security

Penetration testing

CI/CD security tooling

AWS security

Kubernetes/EKS

Threat modelling

Security architecture

AI security

Tools

SAST

SCA

DAST

Container scanning

IaC security

CI/CD integration

Job description

We're partnered with a fast-scaling healthcare technology company building modern data infrastructure that is transforming healthcare delivery and improving patient outcomes at scale.

They're looking for a Principal Application Security Engineer to take ownership of application and product security across a complex, cloud-native SaaS environment. Reporting directly to the Chief Information Security and Privacy Officer, you'll play a key role in shaping secure development practices, driving AppSec automation, and embedding security into the way products are designed, built, tested, and released.

What's on offer

• Up to $270k total compensation ($230k base + 15% target bonus)
• US remote
• Principal-level individual contributor role with significant ownership and influence

The role

• Own and evolve the end-to-end application security programme across a large-scale, AWS-based SaaS platform
• Lead secure SDLC initiatives, embedding security into product architecture, engineering workflows, and release processes
• Build and optimise automated AppSec capabilities across CI/CD pipelines, including SAST, SCA, secrets detection, container scanning, and infrastructure-as-code security
• Drive threat modelling, secure architecture reviews, and vulnerability management across products, APIs, and cloud infrastructure
• Design and implement security release gates, launch readiness checklists, and developer guardrails to prevent vulnerabilities reaching production
• Conduct hands-on penetration testing across web applications, APIs, cloud environments, and multi-tenant architectures
• Establish security controls for AI-assisted development and agentic AI features, including prompt injection, data leakage, and tool abuse risks
• Own external penetration testing programmes, coordinating testing, remediation, and validation of findings
• Partner closely with Product, Engineering, DevSecOps, and leadership teams to improve security maturity and establish scalable secure development practices

Requirements

• Strong background in application security, product security, offensive security, or security engineering, ideally operating at Staff or Principal level
• Proven experience owning or leading an application security programme within a SaaS or cloud-first environment
• Hands-on experience with penetration testing across web applications, REST/GraphQL APIs, and cloud infrastructure
• Strong experience building and integrating AppSec tooling into CI/CD pipelines, including SAST, DAST, SCA, secrets detection, and container security
• Experience designing secure SDLC processes, security release gates, and developer security standards
• Strong understanding of threat modelling, secure architecture, OWASP vulnerabilities, and application security best practices
• Hands-on experience with AWS security, Kubernetes/EKS, IAM, and cloud-native architectures
• Experience securing AI-enabled applications or implementing security guardrails for AI-assisted development
• Familiarity with regulated environments and frameworks such as HIPAA, SOC 2, HITRUST, or ISO 27001
• Strong communication skills with the ability to influence engineering teams and senior technical stakeholders

Bonus

• Experience testing LLM or agentic AI systems, including prompt injection, excessive agency, and data exfiltration
• Exposure to software supply chain security, SBOMs, and coordinated vulnerability disclosure
• Experience building developer security champions programmes or contributing to open-source security tooling
• Security certifications such as OSCP, OSWE, OSCE, GWAPT, GPEN, CSSLP, or CISSP

Why Join?

This is a high-impact opportunity within a mission-driven healthcare technology business where you'll have the autonomy to own and shape application security at scale. You'll work closely with engineering leadership, drive modern AppSec automation and AI security initiatives, and help secure technology that genuinely improves healthcare outcomes.