Senior Application Security Engineer II

The role

You will own AppSec processes end to end and guide developers on solving security problems. You will work across a stack including TypeScript, Node.js, Postgres, and AWS cloud infrastructure.

What you will do

• Threat model technical design documents and run white-box penetration tests
• Triage researcher reports, reproduce impact, and coordinate fixes for VDP and bug bounty
• Contribute directly to the code base by writing patches
• Modify and extend security tooling including Datadog, secrets scanning, and Burp Suite
• Build with AI using Claude Code and Cursor
• Participate in weekly standups, biweekly security champions sessions, and weekly Hack The Box sessions
• Enforce software supply chain provenance including SBOM, dependency pinning, and runtime SCA detections

Required qualifications

• 5 to 6 years of professional security experience in application security, penetration testing, or product security engineering
• Experience shipping production-level software
• Ability to read an unfamiliar codebase to fix code
• Deep understanding of OWASP Top 10 and real-world exploitation/mitigation techniques
• Experience using AI tooling in daily work and building with it
• Ability to mentor team members and members of other teams on security best practices

Benefits

• Compensation follows impact

Before you apply

• All offers of employment are conditional upon a successful background check and employment verification through Certn

About the company

Relay is a digital banking platform that gives self-made business owners tools to manage money by replacing financial guesswork with real visibility.