Senior Application Security Engineer
Sardine
Opportunity published from Ashby · applications stay with the original hiring source.
About the opportunity
- Sardine is seeking a remote security professional based in the United States to join our application security team.
- In this role, you will secure our platform where money moves, finding vulnerabilities such as authorization flaws and business logic abuse to eliminate entire classes of bugs.
- You will manage and automate the vulnerability pipeline, handling findings from SAST, DAST, SCA, code review, pentests, and bug bounties, while driving root-cause remediation and establishing secure defaults for services built in Go, Node.js, Python, Ruby, and Java on multi-cloud and Kubernetes.
- Operating in a remote-first culture, you will collaborate asynchronously across time zones with engineering teams to conduct threat modeling, manual code reviews, and hands-on testing of our applications and APIs.
Key responsibilities
- Run and automate the end-to-end vulnerability management pipeline using code against scanner, ticketing, and source-control APIs.
- Manage external pentests and bug bounty programs by setting scope, directing testers, judging severity, and driving remediation.
- Identify patterns across findings to remove root causes, create secure defaults, and write custom static analysis rules for anti-patterns.
- Review platform-layer controls including authorization, service identity, secrets handling, and gateway enforcement to close gaps with owning teams.
- Conduct hands-on testing of applications and APIs, manual code reviews of high-exposure services, and threat modeling on new designs.
- Drive security enablement across engineering, including participation in a security champions program.
Qualifications
- End-to-end experience running and automating vulnerability management with code against APIs.
- Strong engineering background with experience shipping, maintaining, and reviewing software across architecture and failure modes.
- Code auditing experience in at least one of Go, Python, Node.js, Ruby, or Java, with willingness to work across the others.
- Practical command of the OWASP Top 10, with real depth in broken access control and business logic flaws.
- Experience integrating and tuning SAST, DAST, and SCA in CI/CD pipelines, along with cloud fundamentals on GCP or AWS, Docker, and Kubernetes.
- Ability to separate real findings from theoretical ones and influence engineering teams asynchronously across time zones.
Nice to have
- Experience scaling security tooling across multiple repositories, languages, and build systems.
- Prior experience writing custom static analysis rules using tools like Semgrep or CodeQL.
- Background in fintech, payments, or environments subject to strict third-party security reviews such as PCI DSS and SOC 2.
- Prior fully distributed, asynchronous engineering experience.
- Offensive security experience including pentesting, red team engagements, hardware work, or CTF and bug bounty results.
Benefits
- Generous compensation in cash and equity with early exercise for all options.
- Health insurance, dental, and vision coverage for employees and dependents.
- 4% matching in 401(k) for US employees.
- Flexible paid time off and year-end break.
- Equipment provided, including a MacBook Pro and a one-time home office setup stipend.
- Monthly meal and social meet-up stipends.
- Annual health, wellness, and learning stipends.
Job details
- Location: Remote - United States
- Status: Remote-first
About the company
- Sardine is the leading agentic risk platform for fighting financial crime, unifying data to stop fraud in real time, prevent AI-driven attacks, and automate fraud and AML operations.
- Our platform is backed by a rapid fraud consortium spanning over 6 billion profiled devices, 800 million consumers, and 3 million businesses globally, trusted by leading companies such as FIS, GoDaddy, Intuit, Edward Jones, ZoomInfo, and Checkout.com.
- We cultivate a remote-first culture that values performance and extreme ownership, empowering talented self-motivated individuals to do their best work from anywhere within their hired country.
Application: UpVagas lists this opportunity from the hiring company or its recruitment platform. The application is completed at the original source.
Full listing
UpVagas condensed repetitive or legal boilerplate to make this page easier to read. The original hiring source contains the complete job description.
Source transparency. UpVagas organizes information provided by the company or recruitment source. Always review the original listing before submitting personal information.
