Application Security Engineer

🧡📦💙Founded in 2012, EasyPost is a YC unicorn whose mission is to make shipping simple for businesses—from garage startups to the Fortune 500. Shipping, now more than ever, is the backbone of the global economy, but integrating the technology-enabled operations of a modern business with the low-tech and complex shipping industry has always been a challenge. EasyPost solves this problem with the first developer-friendly REST API for shipping, and we continue to push boundaries and discover new ways to simplify shipping for all. Our team is rapidly growing, and this is the perfect time to get on board. Join us and help build the shipping infrastructure of the future. We’re builders, problem-solvers, and “there has to be a better way” people. We like elegant architecture, fast decisions, and shipping (pun intended) improvements that power millions of deliveries every day. We stay scrappy, we move fast, and we don’t wait for permission to innovate in an industry that desperately needs it. If you want to work on systems that actually move the world—literally—you’re in the right place. 🚚✨EasyPost does not consider candidates who misrepresent their identity, experience, employment history, or technical qualifications. Applications containing false information, stolen professional profiles, or unverifiable credentials will be removed from consideration. We conduct early-stage verification of resumes, LinkedIn profiles, GitHub accounts, and other relevant professional information as part of our hiring process.Position Summary: The Application Security Engineer III will serve as a technical leader dedicated to helping us build an even more secure software ecosystem for our customers. Beyond identifying and mitigating vulnerabilities, you will architect comprehensive defense strategies and embed security into the fabric of our development lifecycle. Your efforts will help drive our application security posture forward, safeguarding sensitive data and ensuring compliance with industry standards while also preserving engineering velocity.Essential Duties and Responsibilities:The essential functions include, but are not limited to the following:Lead Security Architecture: Design, build, and maintain scalable security systems and infrastructure that align with the organization's evolving business goalsEmbed Security by Design: Partner with cross-functional teams to integrate security and privacy controls into the product lifecycle, from project inception to final deliveryScale Security Operations: Build automated systems and programs that allow security at EasyPost to scale efficiently in both breadth and depth of coverageDrive DevSecOps Adoption: Champion "shift-left" methodologies, utilizing Infrastructure-as-Code and CI/CD design patterns to move security feedback to the earliest phases of developmentProduct Innovation: Architect and build competitive customer-facing security features that support business growth and appeal to security-conscious marketsIntelligent Notifications: maintain high-fidelity alerting/notification infrastructure that delivers timely, relevant, and actionable intelligence to internal staff and customersEnablement & Education: Create self-service documentation, training materials, and knowledge base resources that empower developers to write safer code and increase productivityM&A Integration: Collaborate directly with M&A entities to assess risks, integrate products, and unify diverse environments under our security standardsMinimum Education & Experience Qualifications:Bachelor's degree in computer science, management information systems, or related field5+ years of related experience, master’s degree and 3+ years of related experience, or equivalent related work experienceAbility to code proficiently in at least two of the following programming languages: Python, Ruby, Go, and RustAbility to design systems that are simple to understand, maintainable, scalable, and resilientPrior experience securing large-scale web applications and/or Application Programming Interfaces (APIs), including performing security design reviews, vulnerability assessments, and building testing strategies for logic flawsThe ability to understand and communicate concepts around threat modeling and risk management, including to both technical and non-technical stakeholdersProven history of building strong partnerships with Engineering and Product teams to deliver world-class products and featuresWorking knowledge of several compliance and regulatory frameworks (SOC2, ISO 27001, SOX/ITGC, HIPAA, GDPR, CCPA, etc…)Experience in assessing risk and selecting key objectives during the vendor management lifecycle for software, hardware, cloud, and software-as-a-service vendorsDeep knowledge of how to build and maintain mixed computing environments (Linux, Windows, Mac OS, and mobile devices)Past experience with migrating applications and services to public cloud providers (AWS, GCP, Azure, etc…)Core Competencies Required: Knowledge and Application: Complete knowledge and full understanding of areas of specialization, principles and practices within a professional discipline. Assesses unusual circumstances and uses sophisticated analytical and problem solving techniques to identify causes. Resolves and assesses a wide range of issues in creative ways and suggests variations in approach. This job is a fully qualified, experienced professional, journey-level positionComplexity & Problem Solving: Works on problems of diverse scope where analysis of information requires evaluation of identifiable factors. Devises solutions based on limited information and precedent and adapts existing approaches to resolve issues. Uses evaluation, judgment, and interpretation to select the right course of action. Work is done independently and is reviewed at critical pointsCollaboration & Interaction: Enhances relationships and networks with senior internal/external partners who are not familiar with the subject matter, often requiring persuasion. Adapts style to different audiences and often advises others on difficult mattersWhat We Offer:Comprehensive medical, dental, vision, and life insuranceCompetitive compensation package and equityMonthly work from home stipend of $50Flexible work schedule and paid time offCollaborative culture with a supportive teamA great place to work with unlimited growth opportunitiesThe opportunity to make massive contributions at a hyper-growth companyMake an impact on a product helping ship millions of packages per dayData Privacy Notice for Job Applicants:For information on personal data processing, please see our Privacy Policy: https://www.easypost.com/privacy"EasyPost is an Equal Opportunity Employer. Employment decisions are made without regard to race, color, religion, national or ethnic origin, sex, sexual orientation, gender identity or expression, age, disability, protected veteran status or other characteristics protected by law."To be considered for this position, you must be authorized and based in the United States.If you have any questions or concerns you can reach out to me directly on LinkedIn @KristinaPerna :).Any communication to applicants relating to the EasyPost hiring process will only come from email addresses with the domains kperna@easypost.com and pcardona@easypost.com. If in the course of the application or hiring process with EasyPost you are contacted through another domain, are requested to provide banking or other sensitive information, or you note any other suspicious activity, please contact recruiting@easypost.comWe may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.