Staff Application Security Engineer

Job not on LinkedIn

🔥 0 minutes ago

🇺🇸 United States – Remote

💵 $177k - $240k / year

⏰ Full Time

🔴 Lead

💻 Application Engineer

👻 Ghost score 3%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Fingerprint

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2019

🔒 Cybersecurity

🔌 API

☁️ SaaS

💰 $32M Series B on 2021-11

Cybersecurity • API • SaaS

Fingerprint is a technology company focused on bot detection and identification solutions. The platform helps businesses ensure a secure online environment by accurately identifying users and distinguishing between real users and automated bots. They provide developer guides and workspace settings for easy integration into various applications, enhancing security and user experience.

📋 Description

• Design and build Fingerprint's secure development lifecycle, including security requirements, threat modeling, secure code review, and pre-release security testing • Own and operate SAST, DAST, SCA/dependency scanning, secrets detection, and container/IaC scanning in CI/CD • Build AI-first security tooling for triage, auto-remediation, security review agents, and AI-augmented testing • Establish secure defaults, hardened libraries/frameworks, and reusable security patterns • Write code, security libraries, CI integrations, and automation in engineering repositories • Lead threat modeling and architecture security reviews across APIs, web/mobile SDKs, dashboards, and data pipelines • Run vulnerability management, including triage, risk rating, remediation, and SLAs • Partner with Compliance on penetration testing, retesting, and remediation • Perform hands-on security testing for authentication, authorization, APIs, injection, SSRF, business logic, and abuse paths • Lead application-layer security incident investigation, containment, root cause analysis, and remediation • Define application security logging and alerting with Cloud Platform and engineering teams • Support engineering through office hours, design consultations, secure coding guidance, and a Security Champions program • Develop and deliver secure coding training; mentor engineers through code review and design feedback • Partner with the Senior Manager, Application Security on the roadmap and own technical execution • Provide engineering evidence for security controls and support enterprise customer security conversations and vendor assessments

🎯 Requirements

• 8+ years in software engineering and/or security engineering, with 5+ years focused on application security • Production-quality coding ability in TypeScript/JavaScript, Go, Python, or similar • Understanding of modern web and API architectures • Deep practical AppSec expertise, including OWASP Top 10, authentication and authorization, API security, injection, SSRF, cryptography misuse, business-logic, and abuse flaws • Experience leading threat modeling and design-time security reviews for complex systems • Experience deploying and tuning SAST/DAST/SCA/secrets-detection tooling in CI/CD • Experience running AI-assisted code analysis, triage, or auto-remediation in a real program; daily use of AI agents • Vulnerability management ownership, including triage, severity rating, remediation tracking, and penetration-test programs with SLAs • Track record of influencing engineering teams without authority • Clear written and verbal communication of technical risk • Must be authorized to work from the home location • Nice-to-have: fraud detection, bot mitigation, identity, or device intelligence experience • Nice-to-have: AWS cloud security, Wiz or equivalent CSPM, client-side/mobile SDK security, multi-tenant SaaS, bug bounty operations, AI/ML security, autonomous or AI-augmented penetration testing, security certifications, published research/CVEs/open-source contributions, and SOC 2/ISO 27001 controls experience

🏖️ Benefits

• 100% remote work • Globally distributed, remote-first team • Inclusive work environment • Opportunity to shape a dedicated AppSec function from its first days • Staff-level scope and autonomy • Modern security stack and tooling including Snyk, Wiz, Cloudflare, and Okta • Compliance, IT, and infrastructure owned by dedicated teams, allowing focus on engineering • Visa sponsorship is not provided