Senior Security Engineer, Application Security

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Security Engineer, Application Security based in the United States. In this remote role, you will help shape and strengthen security across cloud infrastructure, applications, and emerging AI-powered products. You will take ownership of complex security initiatives, from architecture and threat modeling to implementation and incident response. Working closely with product and engineering teams, you will embed security into development workflows from the earliest design stages. You will also build practical tools and frameworks that make secure development easier and more consistent. This is an opportunity to influence security strategy in a fast-evolving technology environment where AI-driven experiences and sensitive user data require thoughtful protection. Applicants located in the Eastern or Central time zones are preferred to align with team working hours. \n Accountabilities

Lead security initiatives from planning through implementation across cloud infrastructure hardening and application security, including complex projects with evolving requirements.

Own and maintain technical security controls supporting compliance frameworks such as PCI DSS, including ASV scanning, network security control reviews, and tamper-detection monitoring.

Deploy, configure, and optimize infrastructure protections against application exploitation, account takeover, and denial-of-service attacks.

Define security architecture and conduct threat modeling for AI-powered products, including voice and chat agents with access to calendars and user accounts.

Review technical proposals, product requirements, and merge requests from a security perspective, partnering directly with product and engineering teams during the design and development of new features.

Develop security tooling, automation, and engineering frameworks that make secure implementation the easiest path for development teams.

Mentor engineers across teams and identify opportunities to improve security practices, recurring incident patterns, tooling gaps, and inefficient processes.

Participate throughout the incident response lifecycle, including involvement in a 24/7 on-call rotation.

Continuously evaluate and integrate AI-driven tools into security workflows, using AI-assisted coding and security solutions to improve efficiency and effectiveness.

Provide security guidance and practical recommendations that balance risk reduction, product usability, and engineering delivery.

Requirements: 5+ years of experience in security engineering, with experience across at least two of the following areas: application security, cloud or infrastructure security, and enterprise security.

Hands-on experience with AWS and infrastructure-as-code tools such as Terraform, CloudFormation, or equivalent technologies.

Ability to read, review, and contribute to product or service code; experience with Kotlin, Next.js, Python, Ruby, Scala, or Swift is preferred.

Strong understanding of the OWASP Top 10 and practical approaches to identifying and remediating common application vulnerabilities.

Familiarity with authentication and authorization standards, including OAuth, OpenID Connect (OIDC), and SAML.

Exposure to security risks in LLM and agentic systems, including prompt injection, agent identity, and data exfiltration through AI-powered applications.

Regular, practical use of AI-assisted coding and security tools, with the ability to explain how you guide, validate, and verify AI-generated output.

Strong written communication skills, including experience producing threat models and providing clear security feedback on design documents and merge requests.

Experience implementing the technical controls required by compliance frameworks such as PCI, SOX, or similar standards, including vulnerability scanning, control reviews, and tamper detection.

Familiarity with application security tools such as Snyk, Veracode, or Fortify; infrastructure vulnerability scanners such as Qualys, Tenable, or Rapid7; and penetration testing tools such as Burp Suite or OWASP ZAP is preferred.

Experience with containers and Kubernetes is an advantage.

Strong problem-solving skills, sound technical judgment, and the ability to work independently while collaborating effectively with distributed teams.

Candidates based in Eastern or Central US time zones are preferred.

Benefits: Annu