Senior Full Stack Security Engineer (Application & Product)

Skills

About the Role

You will secure our customer-facing products, APIs, and internal services by embedding with engineering teams. You'll lead threat modeling, architecture and code reviews, write code to fix vulnerabilities in Python, Go, or JavaScript/TypeScript, and build automated security guardrails into CI/CD pipelines. You'll also manage WAF, bot protection and API gateways, train developers on secure coding, support compliance efforts and help triage bug bounty reports.

Requirements

• 5+ years of experience in application security, product security, or software engineering with a heavy security focus
• Strong programming and code-review skills in Python, Go, JavaScript/TypeScript, or similar
• Deep understanding of web application vulnerabilities (OWASP Top 10), API security (REST/GraphQL), and authentication flows (OAuth, OIDC, JWT)
• Hands-on experience with offensive web security testing tools (e.g., Burp Suite, ZAP)
• Experience building and maintaining automated security pipelines (DevSecOps)
• Ability to translate complex security risks into actionable engineering tasks
• Eligible to work in the United States

Responsibilities

• Lead threat modeling, architecture reviews, and code reviews for web applications, APIs, and microservices
• Develop and commit code to fix security flaws in Python, Go, or JavaScript/TypeScript codebases
• Implement, tune, and manage security testing tools (SAST, DAST, SCA) in CI/CD pipelines
• Configure and manage WAF, bot protection, and API gateways
• Provide security guidance, secure coding training, and standard operating procedures to development teams
• Collaborate with operations on compliance (SOC 2, ISO 27001, GDPR) and participate in bug bounty triage

Benefits

• Stock options
• Medical, dental and vision plans
• Flexible PTO
• Remote-first work
• $1,200 home office and equipment stipend