Senior Application Security Engineer

Own vulnerability management end to end: identify, triage, prioritize by real-world risk, and drive remediation across our product, codebases, and cloud infrastructure on AWS, GCP, and Cloudflare. Build and operate the AppSec tooling pipeline, including secrets scanning in CI, SCA/dependency scanning with triage SLAs, and SAST rollout on sensitive repos. Set and enforce security hygiene standards within codebases, explicitly accounting for AI-generated code through authorship transparency and mandatory human review on security-sensitive paths. Partner with the internal AI team to design guardrails that keep AI-assisted development safe by default, covering sanctioned tooling, data handling boundaries, and dependency vetting. Secure the SaaS stack by hardening configurations, reviewing OAuth grants, and reducing misconfiguration risk across platforms like Google Workspace, GitHub, Rippling, and Slack. Establish conditional access and identity-layer controls in partnership with IT, including SSO, phishing-resistant MFA, and managed-device posture. Define cloud and SaaS configuration baselines for the infrastructure footprint. Contribute to detection and response readiness by developing high-signal detections and participating in incident response when needed. Work cross-functionally with Engineering, IT, and the internal AI team to articulate risk and remediation paths to both technical and non-technical stakeholders.