W2 - 10+ Application Security Engineer - (Bay Area/NYC/REMOTE)

Position Details

Role: Senior Application Security Engineer
Location: Our staffing locations, in order of preference, are:

General position overview

 Key Responsibilities

• Construct minimal local test environments, dependency mocks, and reproduction harnesses to validate reported security findings.
• Distinguish true, exploitable vulnerabilities from scanner false positives and attach clear, reproducible evidence to issue tickets.

• Supervise, review, and validate code patches generated by automated and AI/agentic remediation systems before they are routed to product code owners.
• Inspect code diffs for logic flaws, hallucinations, off-by-one errors, memory safety issues, and unintended functional regressions.
• Execute unit, integration, and differential tests to confirm both fix efficacy and build stability (targeting a ≥90% patch acceptance rate by code owners without major revision).

• Review, filter, and prioritize incoming findings from automated static (SAST) and dynamic/endpoint scanning tools within a 24–48 hour turnaround window.
• Classify vulnerability severity using standardized scoring rubrics and map valid findings to strict remediation SLAs.
• Evaluate standard compliance exception requests against established security policies and escalate ambiguous, disputed, or architectural edge cases to senior security leads.

• Document architectural entry points, trust boundaries, attack surfaces, and data flows for high-priority services.
• Maintain standardized threat models and service risk classification tags in centralized repositories.

• Route verified, test-passing security patches (changelists / pull requests) to designated product engineering owners.
• Shepherd fixes through code review, track remediation SLAs, and verify end-to-end deployment to production.

• Experience: 5+ years of hands-on experience in Application Security, Product Security, or Software Engineering with a strong focus on vulnerability validation, secure code review, and test automation.
• Programming & Test Harness Development: Proficiency in reading, writing, and debugging code in at least two core languages (C++, Go, Java, or Python), with the ability to set up local test harnesses, mock dependencies, and build minimal PoCs.
• Secure Code Review: Deep understanding of secure coding standards (input validation, boundary checking, safe memory access, concurrency safety) and high attention to detail when reviewing code diffs for regressions, hallucinations, or off-by-one errors.
• Vulnerability & Policy Fundamentals: Working knowledge of common vulnerability classifications (CWE, CVE, OWASP Top 10), vulnerability scoring matrices, and SLA-driven remediation workflows.
• Threat Modeling: Understanding of architectural trust boundaries, data flows, attack surfaces, and structured threat modeling frameworks (e.g., STRIDE, PASTA).
• Engineering Communication: Clear written and verbal communication skills to document reproduction steps, justify severity classifications, and collaborate constructively with software engineering owners through code review.

• AI / Automated Remediation QA: Experience validating, debugging, or prompt-tuning automated code generation tools, along with automated patch validation and differential testing.
• Advanced Dynamic Testing: Practical experience with fuzz testing, unit/integration test frameworks, sandbox execution environments, and debugging complex runtime or logic errors across service