Staff Application Security Engineer

DC, Remote. Posted 4 days ago

The role

You will own the application security program and scale secure software delivery. You will reduce risk across mobile, web, and cloud systems by driving remediation and building engineering guardrails.

What you will do

Own Upside's application security program, standards, and vulnerability management pipeline
Drive vulnerability management outcomes by triaging and tuning findings from scanning, code review, and annual penetration tests
Lead application security reviews and threat models for mobile, web, backend, and AI systems
Extend AI automation for triage, prioritization, and remediation guidance
Build scalable guardrails including repository baselines, GitHub checks, and secure-by-default patterns for AWS
Partner with engineering teams to get fixes shipped and verified
Document risk decisions with clear mitigation plans

Required qualifications

6+ years in application or product security, or equivalent depth in secure software engineering with meaningful application security ownership
Strong Python code review skills
Track record of shipping security improvements that reduced real risk
Experience with threat modeling and secure design review
Practical, everyday use of AI in your security work
Working knowledge of AWS security (Lambda, API Gateway, IAM least privilege, secrets handling)
Working knowledge of CI/CD security in GitHub Actions

Benefits

Medical, dental, and vision coverage starting on Day 1
Equity (ISOs)
401(k) program
Family planning programs + paid parental leave
Physical fitness and wellness memberships
Emotional and mental health support programs
Unlimited PTO
10 paid federal holidays
Annual, week-long Winter Break
Flexible work environment
Lunch reimbursement for in-office employees
Employee Resource Groups

About the company

Upside created technology to transform brick-and-mortar commerce using online retail sophistication. Their platform helps users earn cashback and helps businesses earn measurable profit.