Staff Application Security Engineer

The role

This person will conduct security assessments, identify and mitigate risks, and implement security best practices across Product, Platform, and Engineering teams. They will also develop secure coding standards and integrate security reviews into the CI/CD pipeline.

What you will do

• Develop and implement secure coding practices, procedures, and standards
• Conduct application security assessments and vulnerability testing
• Perform security reviews of code changes
• Collaborate with cross-functional teams to remediate software vulnerabilities
• Integrate security review processes into CI/CD pipeline
• Conduct threat modeling and risk analysis
• Provide domain expertise on protective controls including system, network, encryption, and authentication services
• Work with SRE, Development, IT, and Security teams to drive cybersecurity posture changes
• Work with risk and governance teams to implement compliance and security requirements
• Contribute to secure coding and cybersecurity training programs

Required qualifications

• Strong proficiency in either Typescript or Javascript
• 3+ Years of experience working in application security or software development
• In-depth knowledge of application security concepts and practices, including OWASP Top 10 and SANS Top 25
• Experience with security testing tools such as Burp Suite, AppScan, and Nessus
• Experience operating in any cloud provider (AWS, GCP, Azure, Digital Ocean etc.)
• Ability to appropriately prioritize and respond to different escalations
• Experience working collaboratively with cross-functional teams
• Strong desire to take ownership of problems
• Comfort working in a rapidly evolving environment and dealing with ambiguity
• Excellent communication, analytical and problem-solving skills
• Team and goal-oriented
• High output, low ego

Nice to have

• AI penetration testing
• Experience with git and software branching and workflow strategies
• Experience working with modern, microservice architectures including in Kubernetes or other containerized environments
• Experience with enterprise observability platforms such as ELK, Datadog, Prometheus, Grafana, etc.
• Knowledge of Terraform or other infrastructure-as-code and configuration management solutions
• Experience with SOC 2, ISO 27001, NIST, and CIS standards and frameworks
• Experience with SAST and SCA tools such as Snyk, Checkmarx, Veracode, WhiteSource, or Black Duck

Benefits

• 100% health coverage for employees (medical, dental, and vision)
• 75% coverage for dependents with buy-up plan options
• Gender-neutral parental leave and compassionate leave
• Family forming support through Maven
• Paid time off
• Monthly stipends for wellbeing, hybrid work, and cell phone use
• Mental health support through Modern Health
• Pre-tax commuter benefits
• 401(k) plan with Fidelity with employer match
• Regular team events
• Equity awards

About the company

Ironclad is building AI on enterprise datasets including over 2 billion contracts. The company is recognized as a leader in Contract Lifecycle Management and is backed by investors including Accel, Y Combinator, and Sequoia.