Staff Application Security Engineer

Join us on our mission to make a better world of work.

Culture Amp is the world’s leading employee experience platform, revolutionizing how 25 million employees across more than 6,500 companies create a better world of work. Culture Amp empowers companies of all sizes and industries to transform employee engagement, drive performance management, and develop high‑performing teams. Powered by people science and the most comprehensive employee dataset in the world, the most innovative companies including Canva, On, Asana, Dolby, McDonalds and Nasdaq depend on Culture Amp every day.

Culture Amp is backed by leading venture capital funds and has offices in the US, UK, Germany and Australia. Culture Amp has been recognized as one of the world’s top private cloud companies by Forbes and most innovative companies by Fast Company.

For more information visit

As a Staff Application Security Engineer at Culture Amp, you will play a pivotal role in shaping and elevating our application security posture across our global SaaS platform. You’ll be the technical authority for application security, partnering closely with engineering, product, and security teams to embed security best practices throughout the software development lifecycle. Your work will directly protect the data and trust of millions of users, enabling Culture Amp to deliver innovative, secure, and reliable employee experience solutions at scale.

You will drive the strategy and execution of application security initiatives, lead complex security reviews and threat modeling, and scale security through automation and developer enablement. As a senior technical leader, you’ll mentor engineers, influence cross‑functional teams, and champion a culture of security awareness and continuous improvement. Your expertise will help us stay ahead of emerging threats, meet compliance requirements, and ensure that security is a core part of our product DNA.

• Lead and drive the most complex and high‑impact application security reviews, threat modeling, and risk assessments across our product portfolio, providing expert guidance and direction for other team members.
• Collaborate with engineering, product, and platform teams to embed security into the SDLC, including secure design, code review, and automated security testing (Dev Sec Ops ).
• Develop and scale security automation, tools, and centralized libraries that enable developers to build secure applications efficiently and at scale.
• Proactively identify, assess, and address security risks and vulnerabilities in our SaaS environment, including cloud‑native and microservices architectures.
• Own and evolve our vulnerability management programs, ensuring timely triage, remediation, and communication of security issues.
• Mentor and support engineers across the organization, fostering a culture of security awareness, knowledge sharing, and continuous learning.
• Influence and drive cross‑functional security initiatives, partnering with compliance, privacy, and infrastructure teams to meet regulatory and customer requirements (e.g., SOC 2, ISO 27001, OWASP).
• Stay current with the latest security threats, technologies, and best practices, and advocate for their adoption within Culture Amp.
• Represent Culture Amp’s security expertise internally and externally, including supporting customer security reviews and contributing to the broader security community.

• Extensive experience in application security engineering, with a proven track record of leading security initiatives in SaaS or cloud‑native environments.
• Deep technical expertise in secure software development, secure coding practices, and common security frameworks (e.g., OWASP Top 10, NIST, PCI, SOC 2).
• Proficiency in multiple programming languages (e.g., Ruby, Python, JavaScript, Go) and experience with modern web application architectures and cloud platforms (e.g. AWS).
• Strong knowledge of security automation, CI/CD integration, and Dev Sec Ops  practices.
• Experience designing and implementing security tools, frameworks, and processes that scale with developer velocity.
• Demonstra…