Staff Application Security Engineer

Staff/Principal Application Security Engineer A mission-driven Series B SaaS company is hiring a Staff/Principal Application Security Engineer to own application security across a platform that holds highly sensitive PII and PHI for public sector agencies. You'll live in the codebase, building security controls at the application runtime and database layer and using frontier AI tooling to find and fix bugs at scale. You'll report to the CTO, work alongside a small senior security team, and have a path toward a hands-on CISO seat.

Logistics: RemoteHere's what you'll be doing: Build and ship enterprise-grade security controls in the application runtime and database layer, including row-level data encryption Find and fix vulnerabilities at scale through code audits, threat modeling, penetration testing and agentic AI pipelines Set secure coding standards and security direction across the SDLC, the product and the cloud environment Partner with the platform team on IAM and the permissions framework, layering application controls on top Lead AppSec incident response with on-call engineers and write the post-incident analyses Stand up a pre-launch security review process, a vendor-run bug bounty and intake for security researcher reports Secure file upload and download flows and harden PII and PHI handling Integrate application logging and alerting with the SIEMSupport SOC 2 Type II, HIPAA and FedRAMP controls and evidence collection Mentor developers, shape security hiring plans and represent security to leadership And what you need to have: Staff or principal level AppSec or product security experience at a product company Currently writing production code and comfortable in any language; Ruby, Python or Java a plus A track record of security controls you built at the application runtime or database layer Hands-on experience implementing row-level data encryption Strong full-stack, cloud and scalable architecture background Deep web application security knowledge across OWASP Top 10 vulnerability classes Fluency with AI-assisted security tooling and frontier models The ability to explain risk and tradeoffs to engineers, executives and non-technical stakeholders Plus: offensive security consulting, fintech, healthtech or HIPAA, GovTech or FedRAMPNo CTC or sponsorship at this time.