Staff Application Security Engineer (R5949)

The role

Build and lead a company-wide secure software development program. Set secure SDLC policy and standards, and work directly with development, product and platform teams to find, fix and verify application security issues.

What you will do

• Establish and improve company-wide secure SDLC policies, standards and evidence requirements.
• Turn security policy into practical requirements for development, product and platform teams.
• Assess CI/CD pipelines, source control, build environments and release processes; lead improvement roadmaps.
• Develop secure-development guidance, reference architectures, guardrails and exception processes.
• Partner with development teams to triage, prioritize, remediate and verify application security findings.
• Evaluate and run application security tools such as SAST, DAST, SCA, secrets detection and container scanning.
• Lead threat modeling and security design reviews for high-risk applications.
• Run risk-based vulnerability management and open-source governance.
• Mature software supply-chain security, including SBOMs, artifact signing and build provenance.
• Create and lead a security champions program.

Required qualifications

• 7+ years in application security, product security, DevSecOps, secure software engineering or cybersecurity engineering.
• Experience designing or maturing a secure SDLC across multiple engineering teams.
• Strong knowledge of secure coding, application security testing, vulnerability management and DevSecOps.
• Experience working directly with developers to explain findings and guide remediation.
• Hands-on experience with SAST, DAST, SCA, dependency vulnerability management and secrets scanning.
• Experience integrating security controls into source control, CI/CD, build and release workflows.
• Experience with threat modeling, security design review or security requirements definition.
• Knowledge of common application risks, including authentication, authorization, API security, injection and secrets exposure.
• Experience with software supply-chain concepts such as SBOMs, provenance, build integrity and artifact signing.
• Experience with open-source risk management, including transitive dependencies and license obligations.
• Familiarity with NIST SP 800-218 (SSDF), OWASP SAMM, SLSA or similar frameworks.
• Ability to read and assess production code and scripts in modern programming languages.

Nice to have

• Experience implementing SLSA practices, signed attestations, build provenance or hardened build systems.
• Experience with VEX, CSAF, SPDX or CycloneDX.
• Experience securing cloud-native applications, containers, Kubernetes, APIs and infrastructure-as-code.
• Experience with common source-control, CI/CD, cloud and container registry platforms.
• Experience with tools such as Snyk, Checkmarx, Veracode, Semgrep, SonarQube, OWASP ZAP or Burp Suite.
• Experience with NIST SP 800-171, 800-53, CMMC, FedRAMP, ISO 27001 or SOC 2.
• Experience supporting commercial software, government, defense or high-assurance environments.
• Relevant certifications such as CSSLP, CISSP, GWAPT, GWEB, OSWE or GIAC.

Benefits

• Annual bonus.
• Equity.
• Benefits package. Military fellows and part-time employees are not eligible for benefits.
• Temporary employees receive a temporary benefits package after 60 days of employment.

Before you apply

• All offers are contingent on a cleared background check and possible reference check.

About the company

Shield AI is a venture-backed defense-tech company that builds intelligent systems to protect service members and civilians. Its products include Hivemind autonomy software, V-BAT and X-BAT aircraft, and Aechelon simulation technologies.