Application Security Engineer

We are seeking an Application Security Engineer to join our product engineering team. This role focuses on embedded security within internal tooling and supports a roadmap toward a public‑facing SaaS product. The position is remote (United States) and full‑time.

• Serve as the primary security resource for engineering teams in close coordination with information security, advising on design decisions, authentication patterns, and API security as features are built.
• Conduct lightweight, developer‑friendly threat modeling for new features and services, right‑sized to the actual audience and risk profile (internal vs. public‑facing).
• Lead collaboration between engineering and information security teams through architecture and code reviews with actionable guidance that helps teams ship, not slow down.
• Responsible for remediation and enforcement of security standards as set forth by the information security team.
• Define and maintain a tiered security standard that distinguishes expectations for internal tooling, production SaaS, and public‑facing products.
• Engage constructively with the enterprise security organization, translating between compliance and governance language and the engineering team's operational reality.

• Ensure adherence to Git Hub Advanced Security (GHAS) configuration and security standards through ongoing tuning across code scanning, secret scanning, Dependabot, and security campaigns within Git Hub Enterprise.
• Integrate security tooling into CI/CD pipelines as policy‑as‑code feedback loops, not manual gates.
• Develop and maintain Git Hub Actions workflows with reusable, security‑enforcing components.
• Drive remediation velocity metrics and coverage reporting across engineering teams.

• Collaborate with information security teams to assess and secure workloads across Cloudflare (Workers, Access, WAF, Zero Trust) and Azure (Managed Identities, Key Vault, Defender, IAM) for both internal and opco‑facing services.
• Apply platform‑appropriate security controls as our architecture spans both environments, calibrating to the risk profile of each workload.
• Evaluate and harden authentication flows, API security patterns, and service‑to‑service trust boundaries across Cloudflare and Azure environments.
• Contribute to container and cloud workload security as infrastructure patterns evolve.

• Contribute to internal security tooling, automation, and integrations using Python and/or Go.
• Build security utilities such as vulnerability aggregation pipelines, policy enforcement tooling, or developer‑facing security dashboards.
• Collaborate with information security and engineering teams on secure service design patterns, OAuth
  2.0/OIDC flows, and API security controls.

• Support SOC2 readiness as the product matures toward public customers, mapping application security controls to Trust Services Criteria.
• Triage and prioritize vulnerability findings based on actual business risk rather than CVSS scores alone, distinguishing real issues from noise in a SaaS‑native environment.
• Partner with GRC and the enterprise security organization on evidence collection and audit preparation, without allowing compliance prep to dominate engineering time.

• 7+ years in application security, secure software development, or a closely related discipline.
• Demonstrated ability to operate as an embedded security partner within engineering, working side by side with developers.
• Deep, hands‑on experience with Git Hub Advanced Security or equivalent tooling, including code scanning, secret scanning, Dependabot, and security policy enforcement within Git Hub Enterprise.
• Experience with threat‑modeling methodologies (STRIDE, PASTA, or similar) applied to real‑world systems, with instinct for right‑sizing the process to actual risk.
• Proficiency in Python and/or Go, comfortable reading, writing, and reviewing production‑grade code.
• Strong command of OWASP Top
  10, common vulnerability classes, and secure design principles.
• Experience securing SaaS or product engineering workloads rather than enterprise…