At a glance
- Employment
- Full-time
- Workplace
- Remote
- Location
- Remote
About the role
- Sardine is seeking a Senior Application Security Engineer to find authorization flaws and business logic abuse and make whole classes of bugs go away.
- The application security team is small, managing a large estate of Go, Node.js, Python, Ruby, and Java services running on multi-cloud and Kubernetes.
- Your job is to build a vulnerability pipeline that validates, routes, and closes issues with minimal manual effort while establishing secure defaults and patterns.
Responsibilities
- Triage, validate, route, and drive remediation of findings from every source: SAST, DAST, SCA, code review, pentests, and bug bounty
- Build the automation that removes manual effort from vulnerability management steps
- Set scope, direct testers, judge severity, and close the loop for external pentests and bug bounty programs
- Spot patterns across findings and remove root causes rather than just individual instances
- Set secure patterns and defaults that make the right way the easy way
- Write custom static analysis rules for anti-patterns so fixed bug classes stay fixed
- Review platform-layer controls such as authorization, service identity, secrets handling, and gateway enforcement to find gaps and push owning teams to close them
- Work alongside engineers on fixes that are simple, get adopted, and hold
- Perform hands-on testing of applications and APIs, and manual code review of high-exposure services with depth in authorization and business logic
- Conduct threat modeling on new and high-exposure designs and drive security enablement across engineering
Requirements
- Experience running vulnerability management end to end, and automating it with code against scanner, ticketing, and source-control APIs
- An engineering background with experience shipping and maintaining real software, reading unfamiliar code quickly, and reviewing it rigorously
- Ownership to take problems all the way through, including fixes that depend on other teams
- Code auditing experience in at least one of Go, Python, Node.js, Ruby, or Java, and willingness to work in the rest
- Practical command of the OWASP Top 10, with real depth in broken access control and business logic flaws
- Experience with SAST, DAST, and SCA in CI/CD, tuned so engineers trust the output
- Cloud fundamentals on GCP or AWS
- Experience with Docker and Kubernetes
- Ability to separate real findings from theoretical ones
- Ability to disagree in the open with evidence and communicate asynchronously across time zones
Preferred qualifications
- Scaling security tooling across many repositories, languages, and build systems
- Prior experience writing custom static analysis rules such as Semgrep or CodeQL
- Fintech, payments, or other environments under serious third-party security review including PCI DSS, SOC 2, and customer audits
- Fully distributed, asynchronous engineering experience
- Offensive experience including pentesting on web, API, mobile, or cloud, hardware and embedded work, physical security, red team engagements, and bug bounty results
- Advanced offensive certifications such as OSWE, BSCP, CPTS, or CRTO
- Public work including research, tooling, disclosures, and talks
Benefits
- Generous compensation in cash and equity
- Early exercise for all options, including pre-vested
- Flexible paid time off and Year-end break
- Health insurance, dental, and vision coverage for employees and dependents (US and Canada specific)
- 4% matching in 401k / RRSP (US and Canada specific)
- MacBook Pro delivered to your door
- One-time stipend to set up a home office
- Monthly meal stipend
- Monthly social meet-up stipend
- Annual health, wellness, and learning stipends
Workplace
- Remote-first team spread across time zones with no office to report to
Skills
- Go
- Node.js
- Python
- Ruby
- Java
- Kubernetes
- Docker
- GCP
- AWS
- SAST
- DAST
- SCA
Show all 14 skills
- Semgrep
- CodeQL
