Staff Application Security Engineer (R5949)
Remote · USD 143,000-214,000 / year · 7+ years experience · Remote · Posted Sep 23, 2026
At a glance
- Experience
- 7+ years experience
- Workplace
- Remote
- Location
- Remote
- Salary
- USD 143,000-214,000 / year
About the role
- Shield AI is seeking a Staff Application Security Engineer to build and advance a scalable, developer-centered application security program.
- This role establishes company-wide secure software development lifecycle (SDLC) policy and standards, translating them into practical engineering practices.
- The position partners directly with product, platform, and development teams to improve secure development and software supply-chain maturity as an individual-contributor role.
Responsibilities
- Establish, maintain, and continuously improve company-wide secure SDLC policies, standards, control objectives, procedures, and supporting evidence requirements.
- Translate security policy into clear, achievable requirements for development, product, and platform teams without creating unnecessary delivery friction.
- Assess the maturity of development teams, CI/CD pipelines, source-control practices, build environments, and release processes; define and lead practical improvement roadmaps.
- Develop secure-development guidance, reference architectures, reusable patterns, security guardrails, exception processes, and developer enablement materials.
- Partner directly with development teams to identify, triage, prioritize, remediate, and verify application-security findings.
- Evaluate, implement, tune, and operationalize application-security tooling.
- Lead or facilitate threat modeling, security requirements definition, and secure design or architecture reviews for high-risk applications, integrations, and material changes.
- Establish risk-based vulnerability management processes, including severity criteria, remediation service-level objectives, compensating controls, formal risk acceptance, escalation, and exception management.
- Develop and maintain processes for identifying, tracking, and remediating vulnerable third-party, open-source, and transitive dependencies.
- Establish open-source software governance, including component inventory, license identification, license review, approval workflows, and policy enforcement.
Requirements
- 7+ years of experience in application security, product security, DevSecOps, secure software engineering, cybersecurity engineering, or a closely related field.
- Demonstrated experience designing, implementing, or maturing a secure SDLC or application-security program across multiple engineering teams.
- Strong working knowledge of secure coding practices, application-security testing, vulnerability management, software delivery, and DevSecOps principles.
- Experience working directly with developers to explain findings, guide remediation, and improve secure-development practices.
- Hands-on experience with SAST, DAST, SCA, dependency vulnerability management, secrets scanning, and related application-security tooling.
- Experience integrating security controls into source-control, CI/CD, build, release, and deployment workflows.
- Experience performing or facilitating threat modeling, security design review, architecture review, or security requirements definition.
- Knowledge of common application-security risks, including authentication, authorization, API security, insecure deserialization, injection vulnerabilities, insecure dependency use, secrets exposure, and business-logic vulnerabilities.
- Experience with software supply-chain security concepts, including SBOMs, dependency provenance, build integrity, artifact signing, release attestations, and secure artifact management.
- Strong written and verbal communication skills, including the ability to explain technical risk and tradeoffs to developers, leaders, auditors, and nontechnical stakeholders.
Preferred qualifications
- Experience implementing SLSA practices, signed software attestations, build provenance, hardened build systems, or release integrity controls.
- Experience with VEX, CSAF, SBOM formats such as SPDX or CycloneDX, and component or vulnerability intelligence workflows.
- Experience securing cloud-native applications, containers, Kubernetes, APIs, microservices, and infrastructure-as-code.
- Experience with common source-control, CI/CD, cloud, artifact-management, package-management, or container-registry platforms.
- Experience with tools such as Snyk, Checkmarx, Veracode, GitHub Advanced Security, GitLab security tools, Semgrep, SonarQube, OWASP ZAP, Burp Suite, Mend, Black Duck, or comparable technologies.
- Experience with NIST SP 800-171, NIST SP 800-53, CMMC, FedRAMP, ISO 27001, SOC 2, or other regulated-environment requirements.
- Experience supporting commercial software, government, defense, critical-infrastructure, or other high-assurance product environments.
- Relevant certifications such as CSSLP, CISSP, GWAPT, GWEB, OSWE, GIAC, cloud-security certifications, or comparable credentials.
Benefits
- Bonus
- Benefits
- Equity
- temporary benefits package (applicable after 60 days of employment for temporary employees)
Skills
- SAST
- DAST
- SCA
- Kubernetes
- Snyk
- Checkmarx
- Veracode
- GitHub Advanced Security
- GitLab Security Tools
- Semgrep
- SonarQube
- OWASP ZAP
Show all 15 skills
- Burp Suite
- Mend
- Black Duck
