Senior Application Security Engineer

The Senior Application Security Engineer is a senior individual contributor responsible for strengthening Apollo's secure software development lifecycle and reducing application risk across product, platform, and AI-powered features. This role blends deep code-level application security work with strong cross-functional partnership. It includes application security reviews, threat modeling, AppSec tooling, findings triage and remediation follow-through, external testing intake, and developer enablement. This role is calibrated at the L6 senior-IC level: owning semi-annual or annual goals, solving ambiguous problems with sound judgment, improving operational processes, and driving meaningful cross-team collaboration and influence.

Responsibilities

Own and continuously improve the secure software development lifecycle for Apollo applications; Perform application security reviews, threat modeling, and deep code-level analysis for high-impact product, platform, and AI features before launch; Provide practical security architecture guidance to Engineering, Product, and IT teams; Help define and maintain application-security guardrails, secure design expectations, code review standards, and risk models; Drive execution-heavy vulnerability management across internal reviews, bug bounty, pentests, SCA/runtime findings, and research signals, ensuring findings are validated, prioritized, routed, and tracked through remediation and verification within SLAs; Read the code, explain root cause, propose the safest fix, and directly implement or support remediation for complex vulnerabilities; Perform hands-on validation and offensive security testing of applications and fixes, including exploit development, bypass testing, and red-team-style exercises; Configure and improve AppSec tooling and integrations, including SAST configuration, ignore lists, and dashboards; Select, build, or refine security tooling, small automations, and workflow enrichments that reduce manual effort; Use AI to automate and scale security and engineering-adjacent processes while validating outputs; Embed AI-specific security checks into SSDLC reviews and code analysis; Partner cross-functionally on AI security requirements and controls; Support and scale security enablement for engineers and security champions; Provide actionable remediation guidance, secure patterns, and examples to engineering teams; Produce clear documentation, metrics, and written narratives that improve AppSec visibility and decision-making

Requirements

5+ years of software engineering or application security experience, with meaningful hands-on AppSec depth in modern SaaS environments; Strong software development skills and the ability to read, write, and ship production code; Ruby experience is highly valuable, and Python or similar scripting ability is a plus; Strong Linux and cloud fundamentals, ideally with experience in GCP-backed environments; Deep familiarity with common AppSec issues, secure design, secure authentication and authorization patterns, vulnerability management, and developer security tooling; Demonstrated ability to perform deep code review, penetration testing, and exploit-oriented validation, and to either fix vulnerabilities directly or work closely with engineers to land durable remediations; Experience handling findings from bug bounty, pentests, internal reviews, or automated security tooling through closure and verification; Experience using AI-assisted tools, automations, APIs, or structured workflows to improve engineering or security processes at scale; Experience securing AI-powered systems or features, including AI API exposure, prompt and response handling, data protection, misuse scenarios, and monitoring expectations; Strong written and verbal communication, stakeholder management, and influencing skills across technical and non-technical partners

Nice to have

Experience supporting or leading security reviews for AI-native products, internal agents, or AI-assisted engineering workflows; Experience improving secure-by-design practices and AppSec observability in a fast-moving engineering organization; Experience with security training, developer enablement, or security champions programs; Relevant security certifications

Benefits

Equity; company bonus or sales commissions/bonuses; 401(k) plan; at least 10 paid holidays per year, flex PTO, and parental leave; employee assistance program and wellbeing benefits; global travel coverage; life/AD&D/STD/LTD insurance; FSA/HSA and medical, dental, and vision benefits