Staff Application Security Engineer

Requisitos

• 8+ years in software engineering and/or security engineering, with 5+ years focused on application security
• Hands-on AppSec experience at a product company (not consulting/audit)
• Writes production-quality code (TypeScript/JavaScript, Go, Python, or similar)
• comfortable in engineering repos and CI/CD pipelines
• Deep practical AppSec expertise: OWASP Top 10+, authn/authz design, API security, injection, SSRF, crypto misuse, business-logic and abus..
• Led design-time threat modeling and security reviews for complex systems

Desejáveis

• Experience in fraud detection, bot mitigation, identity, or device intelligence
• Cloud security depth on AWS (IAM, network boundaries, secrets management, workload identity)
• familiarity with Wiz or CSPM tooling
• Client-side and mobile SDK security: browser security model, anti-tampering, iOS/Android SDK hardening
• Multi-tenant SaaS experience with high-volume, latency-sensitive APIs
• Bug bounty program operation (HackerOne, Bugcrowd, or equivalent)