Application Security Engineer

🧡📦💙Founded in 2012, Easy Post is a YC unicorn whose mission is to make shipping simple for businesses—from garage startups to the Fortune 500. Shipping, now more than ever, is the backbone of the global economy, but integrating the technology-enabled operations of a modern business with the low-tech and complex shipping industry has always been a challenge. Easy Post solves this problem with the first developer-friendly REST API for shipping, and we continue to push boundaries and discover new ways to simplify shipping for all.

Our team is rapidly growing, and this is the perfect time to get on board. Join us and help build the shipping infrastructure of the future. We’re builders, problem-solvers, and “there has to be a better way” people. We like elegant architecture, fast decisions, and shipping (pun intended) improvements that power millions of deliveries every day. We stay scrappy, we move fast, and we don’t wait for permission to innovate in an industry that desperately needs it.

If you want to work on systems that actually move the world—literally—you’re in the right place.

The Application Security Engineer III will serve as a technical leader dedicated to helping us build an even more secure software ecosystem for our customers. Beyond identifying and mitigating vulnerabilities, you will architect comprehensive defense strategies and embed security into the fabric of our development lifecycle. Your efforts will help drive our application security posture forward, safeguarding sensitive data and ensuring compliance with industry standards while also preserving engineering velocity.

• Lead Security Architecture: Design, build, and maintain scalable security systems and infrastructure that align with the organization's evolving business goals.
• Embed Security by Design: Partner with cross-functional teams to integrate security and privacy controls into the product lifecycle, from project inception to final delivery.
• Scale Security Operations: Build automated systems and programs that allow security at Easy Post to scale efficiently in both breadth and depth of coverage.
• Drive Dev Sec Ops  Adoption: Champion "shift-left" methodologies, utilizing Infrastructure-as-Code and CI/CD design patterns to move security feedback to the earliest phases of development.
• Product Innovation: Architect and build competitive customer-facing security features that support business growth and appeal to security-conscious markets.
• Intelligent Notifications: maintain high-fidelity alerting/notification infrastructure that delivers timely, relevant, and actionable intelligence to internal staff and customers.
• Enablement &
  
  Education:
  
  Create self-service documentation, training materials, and knowledge base resources that empower developers to write safer code and increase productivity.
• M&A Integration: Collaborate directly with M&A entities to assess risks, integrate products, and unify diverse environments under our security standards.

• Bachelor's degree in computer science, management information systems, or related field.
• 5+ years of related experience, master's degree and 3+ years of related experience, or equivalent related work experience.
• Ability to code proficiently in at least two of the following programming languages:
  Python, Ruby, Go, and Rust.
• Ability to design systems that are simple to understand, maintainable, scalable, and resilient.
• Prior experience securing large-scale web applications and/or Application Programming Interfaces (APIs), including performing security design reviews, vulnerability assessments, and building testing strategies for logic flaws.
• The ability to understand and communicate concepts around threat modeling and risk management, including to both technical and non-technical stakeholders.
• Proven history of building strong partnerships with Engineering and Product teams to deliver world-class products and features.
• Working knowledge of several compliance and regulatory frameworks (SOC2, ISO 27001, SOX/ITGC, HIPAA, GDPR, CCPA, etc…)
• Experience in assessing risk and selecting key objectives during…