Application Security and Risk Engineer

Please note, this is a remote role based in one of the 23 States Ladder is currently hiring in - AZ, CA, CO, CT, FL, GA, IA, KS, MA, MD, MN, NC, NH, NJ, NV, NY, OH, OR, PA, TX, VA, WA, WI with the exception of the following cities:
We saw a problem within the life insurance industry: getting covered took too long, involved too much paperwork, and required too many in-person meetings with sales agents. We developed a method of real-time underwriting leveraging AI and, in doing so, reduced the months-long process of applying for life insurance to minutes. Our digital experience is quick (instant decisions!), loved by users (check out our Trustpilot or Google reviews) and prolific ($74 billion+ in coverage provided).

We are looking for a cybersecurity unicorn. A Security Engineer / Analyst who brings a rare blend of application security engineering and risk management maturity. In this role, you will be the driving force behind our vulnerability management lifecycle, balancing day-to-day security operations with development-facing vulnerability management and compliance.

Your primary mission will be embedded within our development life cycles, taking ownership of application security vulnerability management for our engineering teams. Because our backend infrastructure runs heavily on Clojure, you won't just be running automated scanners, you will actively look at code and leverage your functional programming experience to strengthen our shift-left security philosophy. Beyond App Sec, you will wear multiple hats: monitoring our cloud infrastructure and responding to alerts, conducting security risk reviews, supporting compliance audits, and ensuring our day-to-day workspace remains locked down.

We are looking for someone who is organized, self-motivated, has excellent problem-solving and writing skills, and enjoys working with people in a challenging and fast-paced environment. In this role, you will have the opportunity to drive innovation within the reporting function and help build out the accounting function.

Please note, Ladder is not currently sponsoring or transferring OPT or H1-B visa's.

• Secure the Code (Primary):
  Partner directly with development teams to champion application security vulnerability management.
• Security Ops:
  Configure, fine-tune, and monitor our cloud security posture leveraging Security Operations tools (SIEM, SOAR, CSP, CNAPP) to detect and respond to threats in real time.
• Champion Governance & Risk:
  Conduct thorough Security Reviews and risk assessments on internal architecture, third‑party vendors, and APIs to ensure alignment with our corporate risk tolerance and compliance standards.
• Maintain and optimize our day-to-day corporate workspace security, ensuring identity access management, device compliance, and productivity tools are highly secure yet frictionless for the team.
• Mentor engineers on secure coding practices, establish secure defaults, and make practical risk decisions that scale with our growth.

• An Experienced Security Professional: 4+ years of software engineering and/or cybersecurity experience, backed by a strong foundation in Computer Science, Cyber Security, or a related field.
• Hands‑on experience coding in Clojure and working within the JVM environment. You are comfortable reading functional code, understanding immutable data structures, and collaborating directly with backend engineers on code-level fixes.
• A Cloud Sec Ops Practitioner:
  Hands‑on experience securing modern cloud infrastructures, as well as experience working incident response.

• Backend & Code:
  Clojure, JVM, Type Script, Java Script
• Cloud & Infrastructure: GCP, Kubernetes, Docker, Terraform, GraphQL
• Se…