Staff Application Security Engineer

Responsibilities

• Design and build a secure development lifecycle covering security requirements, threat modeling, secure code review, and pre-release testing.
• Own and operate SAST, DAST, SCA, secrets-detection, container-scanning, and IaC-scanning tooling, including AI-assisted triage and remediation.
• Build secure defaults, hardened libraries, reusable security patterns, CI integrations, and automation while contributing code to engineering repositories.
• Lead threat modeling and architecture security reviews for APIs, web and mobile SDKs, dashboards, and data pipelines.
• Run vulnerability management, including triage, risk rating, remediation tracking, and service-level agreements for findings from scanners, penetration tests, bug bounties, and customer reports.
• Perform manual application security testing and exploitation across authentication, authorization, APIs, injection, SSRF, business logic, and abuse paths.
• Lead application-layer security incident investigation, containment, root-cause analysis, remediation, logging, and alerting improvements.
• Provide security enablement through office hours, design consultations, secure coding training, code review, and a Security Champions program.
• Partner with the Application Security Senior Manager, Compliance Lead, Cloud Platform, engineering teams, and enterprise customers on technical security priorities and evidence.

Requirements

• 8+ years of software engineering and/or security engineering experience, with 5+ years focused on application security.
• Production-quality coding ability in TypeScript/JavaScript, Go, Python, or a similar language, along with familiarity with modern web and API architectures and CI/CD pipelines.
• Deep practical application security expertise covering OWASP Top 10, authentication and authorization, API security, injection, SSRF, cryptography misuse, business-logic flaws, and abuse flaws.
• Experience leading threat modeling and design-time security reviews for complex systems.
• Experience deploying and tuning SAST, DAST, SCA, secrets-detection, and related security tooling in CI/CD.
• Real-world experience with AI-assisted code analysis, triage, or auto-remediation and daily use of AI agents in security work.
• Experience owning vulnerability management, severity rating, remediation tracking, and penetration-testing programs with remediation SLAs.
• Demonstrated ability to improve security outcomes across engineering teams through influence, partnership, and effective tooling.
• Experience communicating technical risk to engineers, leadership, and customer security teams.
• Preferred experience in fraud detection, bot mitigation, identity, device intelligence, cloud security, mobile SDK security, multi-tenant SaaS, bug bounty operations, AI/ML security, autonomous penetration testing, security research, or SOC 2/ISO 27001 engineering controls.
• AWS security experience, including IAM, network boundaries, secrets management, and workload identity, plus familiarity with Wiz or equivalent CSPM tooling, is preferred.
• OSCP, OSWE, GWAPT, or CSSLP certification, published research, CVEs, or open-source security contributions are preferred.

Benefits

• The company is 100% remote and globally dispersed, with the role open across the United States and team members able to work from almost any country subject to country restrictions.
• The role offers Staff-level autonomy and the opportunity to establish a dedicated application security function from its first days.
• Compliance, IT, and infrastructure responsibilities are handled by dedicated teams so the role can focus on engineering, findings, and tooling.
• Fingerprint provides an inclusive work environment and encourages applicants from underrepresented groups in technology.