{"schemaVersion":"jobsearcher.job.v1","id":"b776490e6c4540134bff1567","url":"https://jobsearcher.com/jobs/b776490e6c4540134bff1567","canonicalUrl":"https://jobsearcher.com/jobs/b776490e6c4540134bff1567","title":"Senior Application Security Engineer","description":"At Shutterfly, we make life’s experiences unforgettable. We believe there is extraordinary power in the self-expression. That’s why our family of brands helps customers create products and capture moments that reflect who they uniquely are.\n\nThis is an exciting time for Shutterfly, and we are looking for a Senior Application Security Engineer (Offensive / Red Team) to join our team. In this role you will help shape an evolving offensive security practice, leading Red Team engagements against Shutterfly's critical applications while partnering closely with our Blue Team throughout each engagement to produce Purple Team outcomes — stronger detections, faster response, and measurably improved defenses. We're looking for someone who is as passionate about uncovering and exploiting a vulnerability as they are about working alongside defenders to make sure it can be detected, contained, and remediated. Just as important, you'll partner with developers and engineering teams to educate them on how to prevent and avoid vulnerabilities in the first place, and guide them on how to fix issues once identified. Your focus will be on building an offensive security capability that strengthens the entire security program, with collaboration between offense, defense, and engineering at its core.\n\nWhat You'll Do Here:\n\nRed Team Operations: Plan and lead offensive engagements against Shutterfly's applications and supporting infrastructure using established offensive and testing techniques — manual web penetration testing, exploitation, fuzzing, and adversary emulation supported by industry-standard offensive tooling — and coordinate with third-party testers when engagements call for it.\nPurple Team Collaboration: Work hand-in-hand with the Blue Team throughout every engagement. Share tactics, techniques, and procedures in real time, validate and improve detection and alerting coverage, run collaborative exercises, and convert offensive findings into concrete defensive improvements.\nAI-Driven Offensive Security: Augment conventional offensive techniques with AI and LLM-based tooling to accelerate and extend offensive and testing work — reconnaissance, payload and test-case generation, code and configuration review, and exploitation.\nMaintain a working understanding of how threat actors are weaponizing AI, and fold that knowledge into engagements and defensive recommendations to keep pace with a rapidly changing threat landscape.\nBug Bounty Program Management: Manage the bug bounty program end to end — triage, impact assessment, risk scoring (CVSS), locating vulnerable code, providing mitigation guidance, thorough re-testing, and refining program policy and scope as needed.\nVulnerability Management: Identify, triage, and drive remediation of application vulnerabilities through manual testing and exploitation, escalating systemic issues to the appropriate engineering teams.\nThreat Modeling & Risk Assessment: Lead threat modeling exercises and perform risk assessments for new and existing applications, using offensive insight to prioritize the risks that matter most.\nIncident Response: Collaborate with incident response and Blue Team partners to investigate application-related security incidents, applying offensive expertise to scope, reproduce, and understand attacker activity.\nSecure SDLC: Help define and reinforce secure development practices, including code reviews and integration of security checks into the CI/CD pipeline.\nCode Review: Perform and lead security reviews of critical PRs and code changes, and review code in most major languages.\nSecurity Architecture & Design: Partner with engineering and architecture teams to advise on secure systems and applications design, ensuring security is built in from the ground up.\nSubject Matter Expertise: Serve as a top technical resource to engineers across the organization. Help them reproduce vulnerabilities, understand impact, document issues, and validate the effectiveness of fixes.\nMentorship & Leadership: Mentor junior security engineers and developers on offensive techniques, secure coding practices, and security principles. Build relationships with stakeholders and business leaders across the organization.\nCross-Functional Collaboration: Work closely with product, engineering, DevOps, defensive security, and compliance teams to align security with business goals.\nContinuous Improvement: Maintain up-to-date knowledge of relevant offensive techniques, threats, mitigations, security best practices, and the evolving role of AI in both offensive operations and adversary activity.\nSecurity Tooling: Make effective use of the existing security tooling stack (e.g., SAST, SCA, DAST, IAST) to support offensive and defensive work.\n\nRequired Qualifications:\n\nBachelor's degree in computer science, cybersecurity, or a related technical field, or comparable hands-on experience in lieu of a degree.\n\nDemonstrated experience leading or performing offensive security work, such as web application penetration testing or Red Team engagements, with hands-on proficiency in conventional offensive and testing techniques and industry-standard offensive tooling.\nHands-on experience using AI/LLM tools for offensive security or testing, with an understanding of how threat actors are leveraging AI in a rapidly evolving threat landscape.\n\nProficient in one modern programming language (preferably Java) and able to review code in most major languages.\n\nStrong analytical and problem-solving abilities with a risk-based security approach.\n\nAdvanced user of Burp Suite Pro; bonus if you have created custom extensions in Java or Python or have used or modified existing extensions.\n\nExcellent communication and collaboration skills, with the ability to work across offensive and defensive teams, IT, engineering, and business stakeholders.\n\n Preferred Qualifications:\n\nExperience running Purple Team exercises or otherwise collaborating directly with defensive/Blue Team functions to improve detection and response.\nFull stack web development experience within an active security program.\nExperience managing a bug bounty program.\nA security certification that demonstrates proficiency in offensive security, network/web/mobile/AD assessments, secure coding, and professional report creation (for example: OSCP, OSEP, CRTO, OSWA, OSWE, GWAPT, GWEB).\nSubmitted reports to bug bounty programs or VDPs, and you've found a CVE along the way.\nStrong command-line and scripting skills (bash, zsh, Python) on Linux and Mac.\nEnjoy attending security conferences and occasionally participate in CTFs.\nSpend time on cyber security training platforms (HackTheBox, TryHackMe).\nHave worked with engineering teams to develop secure code libraries.\nCapable of rapidly learning and integrating emerging tools and platforms with minimal supervision.\n\nSupporting a diverse and inclusive workforce is important to Shutterfly not only because it directly reflects our value of Embracing our Differences, but also because it’s the right thing to do for our business and for our people. We welcome all applicants and evaluate them based on their qualifications. Learn more about our commitment to Diversity, Equity, and Inclusion on our Career Site.\n\nThe compensation package for this role is based on multiple factors, such as job level, responsibilities, location, and candidate experience. The base pay ranges included below are specific to the locations listed, and may not be applicable to other locations.\n\nCalifornia : [$128,000-181,250]\n\nConnecticut and New York: [$128,000-165,750]\n\nColorado, Illinois, Minnesota and Washington: [$128,000-153,000]\n\nNevada: [$120,250-165,750]\n\nMaryland and New Jersey: [$138,250-165,750]\n\nHawaii : [$120,250-144,750]\n\nThis position may be eligible for a bonus incentive, health benefits, a 401K program, and other employee perks. More details about our company benefits can be found at https://shutterflyinc.com/benefits/.\n\nThis opportunity can be remote, but candidates must reside in a state in which Shutterfly is registered to do business. This includes all US states except District of Columbia, North Dakota, Mississippi, Rhode Island, Vermont, and Wyoming.\n\nThis position will accept applications on an ongoing basis until filled.\n\n#SFLYTechnology","company":"Shutterfly","rawCompany":"shutterfly","city":"Phoenix","state":"AZ","isRemote":false,"isActive":false,"createdAt":"2026-09-19T08:09:59.729Z","occupations":[{"code":"15-1299.05","title":"Information Security Engineers","slug":"information-security-engineers"},{"code":"15-1212.00","title":"Information Security Analysts","slug":"information-security-analysts"},{"code":"15-1299.04","title":"Penetration Testers","slug":"penetration-testers"}],"industries":[{"code":"541512","title":"Computer Systems Design Services","slug":"computer-systems-design-services"},{"code":"541511","title":"Custom Computer Programming Services","slug":"custom-computer-programming-services"},{"code":"513210","title":"Software Publishers","slug":"software-publishers"}],"jobPosting":{"@context":"https://schema.org","@type":"JobPosting","title":"Senior Application Security Engineer","description":"At Shutterfly, we make life’s experiences unforgettable. We believe there is extraordinary power in the self-expression. That’s why our family of brands helps customers create products and capture moments that reflect who they uniquely are.\n\nThis is an exciting time for Shutterfly, and we are looking for a Senior Application Security Engineer (Offensive / Red Team) to join our team. In this role you will help shape an evolving offensive security practice, leading Red Team engagements against Shutterfly's critical applications while partnering closely with our Blue Team throughout each engagement to produce Purple Team outcomes — stronger detections, faster response, and measurably improved defenses. We're looking for someone who is as passionate about uncovering and exploiting a vulnerability as they are about working alongside defenders to make sure it can be detected, contained, and remediated. Just as important, you'll partner with developers and engineering teams to educate them on how to prevent and avoid vulnerabilities in the first place, and guide them on how to fix issues once identified. Your focus will be on building an offensive security capability that strengthens the entire security program, with collaboration between offense, defense, and engineering at its core.\n\nWhat You'll Do Here:\n\nRed Team Operations: Plan and lead offensive engagements against Shutterfly's applications and supporting infrastructure using established offensive and testing techniques — manual web penetration testing, exploitation, fuzzing, and adversary emulation supported by industry-standard offensive tooling — and coordinate with third-party testers when engagements call for it.\nPurple Team Collaboration: Work hand-in-hand with the Blue Team throughout every engagement. Share tactics, techniques, and procedures in real time, validate and improve detection and alerting coverage, run collaborative exercises, and convert offensive findings into concrete defensive improvements.\nAI-Driven Offensive Security: Augment conventional offensive techniques with AI and LLM-based tooling to accelerate and extend offensive and testing work — reconnaissance, payload and test-case generation, code and configuration review, and exploitation.\nMaintain a working understanding of how threat actors are weaponizing AI, and fold that knowledge into engagements and defensive recommendations to keep pace with a rapidly changing threat landscape.\nBug Bounty Program Management: Manage the bug bounty program end to end — triage, impact assessment, risk scoring (CVSS), locating vulnerable code, providing mitigation guidance, thorough re-testing, and refining program policy and scope as needed.\nVulnerability Management: Identify, triage, and drive remediation of application vulnerabilities through manual testing and exploitation, escalating systemic issues to the appropriate engineering teams.\nThreat Modeling & Risk Assessment: Lead threat modeling exercises and perform risk assessments for new and existing applications, using offensive insight to prioritize the risks that matter most.\nIncident Response: Collaborate with incident response and Blue Team partners to investigate application-related security incidents, applying offensive expertise to scope, reproduce, and understand attacker activity.\nSecure SDLC: Help define and reinforce secure development practices, including code reviews and integration of security checks into the CI/CD pipeline.\nCode Review: Perform and lead security reviews of critical PRs and code changes, and review code in most major languages.\nSecurity Architecture & Design: Partner with engineering and architecture teams to advise on secure systems and applications design, ensuring security is built in from the ground up.\nSubject Matter Expertise: Serve as a top technical resource to engineers across the organization. Help them reproduce vulnerabilities, understand impact, document issues, and validate the effectiveness of fixes.\nMentorship & Leadership: Mentor junior security engineers and developers on offensive techniques, secure coding practices, and security principles. Build relationships with stakeholders and business leaders across the organization.\nCross-Functional Collaboration: Work closely with product, engineering, DevOps, defensive security, and compliance teams to align security with business goals.\nContinuous Improvement: Maintain up-to-date knowledge of relevant offensive techniques, threats, mitigations, security best practices, and the evolving role of AI in both offensive operations and adversary activity.\nSecurity Tooling: Make effective use of the existing security tooling stack (e.g., SAST, SCA, DAST, IAST) to support offensive and defensive work.\n\nRequired Qualifications:\n\nBachelor's degree in computer science, cybersecurity, or a related technical field, or comparable hands-on experience in lieu of a degree.\n\nDemonstrated experience leading or performing offensive security work, such as web application penetration testing or Red Team engagements, with hands-on proficiency in conventional offensive and testing techniques and industry-standard offensive tooling.\nHands-on experience using AI/LLM tools for offensive security or testing, with an understanding of how threat actors are leveraging AI in a rapidly evolving threat landscape.\n\nProficient in one modern programming language (preferably Java) and able to review code in most major languages.\n\nStrong analytical and problem-solving abilities with a risk-based security approach.\n\nAdvanced user of Burp Suite Pro; bonus if you have created custom extensions in Java or Python or have used or modified existing extensions.\n\nExcellent communication and collaboration skills, with the ability to work across offensive and defensive teams, IT, engineering, and business stakeholders.\n\n Preferred Qualifications:\n\nExperience running Purple Team exercises or otherwise collaborating directly with defensive/Blue Team functions to improve detection and response.\nFull stack web development experience within an active security program.\nExperience managing a bug bounty program.\nA security certification that demonstrates proficiency in offensive security, network/web/mobile/AD assessments, secure coding, and professional report creation (for example: OSCP, OSEP, CRTO, OSWA, OSWE, GWAPT, GWEB).\nSubmitted reports to bug bounty programs or VDPs, and you've found a CVE along the way.\nStrong command-line and scripting skills (bash, zsh, Python) on Linux and Mac.\nEnjoy attending security conferences and occasionally participate in CTFs.\nSpend time on cyber security training platforms (HackTheBox, TryHackMe).\nHave worked with engineering teams to develop secure code libraries.\nCapable of rapidly learning and integrating emerging tools and platforms with minimal supervision.\n\nSupporting a diverse and inclusive workforce is important to Shutterfly not only because it directly reflects our value of Embracing our Differences, but also because it’s the right thing to do for our business and for our people. We welcome all applicants and evaluate them based on their qualifications. Learn more about our commitment to Diversity, Equity, and Inclusion on our Career Site.\n\nThe compensation package for this role is based on multiple factors, such as job level, responsibilities, location, and candidate experience. The base pay ranges included below are specific to the locations listed, and may not be applicable to other locations.\n\nCalifornia : [$128,000-181,250]\n\nConnecticut and New York: [$128,000-165,750]\n\nColorado, Illinois, Minnesota and Washington: [$128,000-153,000]\n\nNevada: [$120,250-165,750]\n\nMaryland and New Jersey: [$138,250-165,750]\n\nHawaii : [$120,250-144,750]\n\nThis position may be eligible for a bonus incentive, health benefits, a 401K program, and other employee perks. More details about our company benefits can be found at https://shutterflyinc.com/benefits/.\n\nThis opportunity can be remote, but candidates must reside in a state in which Shutterfly is registered to do business. This includes all US states except District of Columbia, North Dakota, Mississippi, Rhode Island, Vermont, and Wyoming.\n\nThis position will accept applications on an ongoing basis until filled.\n\n#SFLYTechnology","datePosted":"2026-09-19T08:09:59.729Z","dateModified":"2026-09-19T08:09:59.729Z","hiringOrganization":{"@type":"Organization","name":"Shutterfly","sameAs":"https://jobsearcher.com"},"jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Phoenix","addressRegion":"AZ","addressCountry":"US"}},"identifier":{"@type":"PropertyValue","name":"JobSearcher","value":"b776490e6c4540134bff1567"},"url":"https://jobsearcher.com/jobs/b776490e6c4540134bff1567"}}