Responsibilities

Design and build a secure development lifecycle covering security requirements, threat modeling, secure code review, and pre-release testing.
Own and operate SAST, DAST, SCA, secrets-detection, container-scanning, and IaC-scanning tooling, including AI-assisted triage and remediation.
Build secure defaults, hardened libraries, reusable security patterns, CI integrations, and automation while contributing code to engineering repositories.
Lead threat modeling and architecture security reviews for APIs, web and mobile SDKs, dashboards, and data pipelines.
Run vulnerability management, including triage, risk rating, remediation tracking, and service-level agreements for findings from scanners, penetration tests, bug bounties, and customer reports.
Perform manual application security testing and exploitation across authentication, authorization, APIs, injection, SSRF, business logic, and abuse paths.
Lead application-layer security incident investigation, containment, root-cause analysis, remediation, logging, and alerting improvements.
Provide security enablement through office hours, design consultations, secure coding training, code review, and a Security Champions program.
Partner with the Application Security Senior Manager, Compliance Lead, Cloud Platform, engineering teams, and enterprise customers on technical security priorities and evidence.

Requirements

8+ years of software engineering and/or security engineering experience, with 5+ years focused on application security.
Production-quality coding ability in TypeScript/JavaScript, Go, Python, or a similar language, along with familiarity with modern web and API architectures and CI/CD pipelines.
Deep practical application security expertise covering OWASP Top 10, authentication and authorization, API security, injection, SSRF, cryptography misuse, business-logic flaws, and abuse flaws.
Experience leading threat modeling and design-time security reviews for complex systems.
Experience deploying and tuning SAST, DAST, SCA, secrets-detection, and related security tooling in CI/CD.
Real-world experience with AI-assisted code analysis, triage, or auto-remediation and daily use of AI agents in security work.
Experience owning vulnerability management, severity rating, remediation tracking, and penetration-testing programs with remediation SLAs.
Demonstrated ability to improve security outcomes across engineering teams through influence, partnership, and effective tooling.
Experience communicating technical risk to engineers, leadership, and customer security teams.
Preferred experience in fraud detection, bot mitigation, identity, device intelligence, cloud security, mobile SDK security, multi-tenant SaaS, bug bounty operations, AI/ML security, autonomous penetration testing, security research, or SOC 2/ISO 27001 engineering controls.
AWS security experience, including IAM, network boundaries, secrets management, and workload identity, plus familiarity with Wiz or equivalent CSPM tooling, is preferred.
OSCP, OSWE, GWAPT, or CSSLP certification, published research, CVEs, or open-source security contributions are preferred.

Benefits

The company is 100% remote and globally dispersed, with the role open across the United States and team members able to work from almost any country subject to country restrictions.
The role offers Staff-level autonomy and the opportunity to establish a dedicated application security function from its first days.
Compliance, IT, and infrastructure responsibilities are handled by dedicated teams so the role can focus on engineering, findings, and tooling.
Fingerprint provides an inclusive work environment and encourages applicants from underrepresented groups in technology.

Staff Application Security Engineer

Start with your email