Software Engineer 3, Security

Welcome to Our World

We’ve been leading the charge in the affiliate industry from day one—establishing performance marketing and paving the way for future innovations. We're known for maintaining one of the largest, most reliable partnership platforms with impeccable, personalized service.

Welcome to Our World

We’ve been leading the charge in the affiliate industry from day one—establishing performance marketing and paving the way for future innovations. We're known for maintaining one of the largest, most reliable partnership platforms with impeccable, personalized service.

Founded in Santa Barbara, California in 1998, CJ (formerly Commission Junction) stands as the most trusted name in performance marketing. We specialize in building partnerships between top brands and reputable publishers to drive revenue and business growth. CJ’s industry-leading solutions make us the platform of choice for over 3,800 global brands across sectors like retail, travel, finance, technology, and home services.

As part of Publicis Groupe, our savvy data capabilities, cutting‑edge tech, and strategic expertise facilitate genuine connections, allowing brands to reach consumers wherever they are.

Think back to your last online purchase. Did an influencer tip you off about a great product and offer a discount? Or perhaps you relied on a trusted review site to make your decision? Whatever path you took, affiliate publishers likely played a role by influencing, informing, or helping you find the best deal. CJ connects brands with these publishers, creating valuable resources for shoppers like you.

You must be work authorized in the United States without the need for employer sponsorship.

This is a hybrid role requiring 3 days a week in a CJ office location ().

We are passionate about software engineering. We build exciting software, with quality and maintainability in mind. We believe in common sense, simplicity, and efficiency. We practice critical thinking, challenge each other no matter the title, and believe in the wisdom of the team.

That makes us Engineers and not just developers. Here are some of the principles that set CJ engineers apart.

• Engineering autonomy:
  Here, business decisions are made by business people, and technical decisions are made by technical people.
• Full stack:
  Expect to be involved and to gain competence in every aspect of software engineering, from frontend, to database, to requirements analysis, to testing, to helping choose technologies.
• Clean, Maintainable code:
  Code is read more often than it is written, so we put in the effort to write it well in the first place.
• Pairing:
  The highest quality code is produced by close collaboration, so we pair by default.
• TDD:
  Quality is baked into our process through Test Driven Development
• Ownership:
  Engineers own the full lifecycle of what they build—from design and implementation to deployment, monitoring, production support, and on‑call rotations. If we build it, we support it.
• Operational Excellence:
  We embrace Infrastructure as Code, CI/CD, automation, and observability to build reliable systems and deliver software safely, efficiently, and at scale.
• We believe in Agile values, and incremental development. We constantly experiment, retrospect, and adjust.
• We are committed to finding out how AI can amplify our productivity. We view AI as a force multiplier, not a replacement for good engineering.

If this sounds exciting, we want to hear from you!

As a Software Engineer 3 focused on security within Engineering Experience (Eng Exp), you help drive the team's evolution from Dev Ops to Dev Sec Ops . You work with engineering teams across the org to find, prioritize, and close out vulnerabilities in CJ's code and infrastructure, and you help serve as a technical bridge between engineering and the Global Security Office (GSO), auditors, and clients on security topics.

You turn raw findings (Wiz, Veracode, pentest reports) into evidence‑backed, actionable guidance. This is a hands‑on role: you read and write code, and when you have the context to fix a vulnerability yourself, you do—not…