Staff Application Security Engineer

Fingerprint

. Design and build Fingerprint's secure development lifecycle, including security requirements, threat modeling, secure code review, and pre-release security testing .

Posted 10/16/2026full-timeRemote • United StatesLead💰 $177,000 - $240,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive expertise in application security, including secure development lifecycle practices, threat modeling, and vulnerability management. Proficient in coding with TypeScript, JavaScript, Go, and Python, while effectively leading security initiatives and mentoring engineering teams.

Highest-signal resume keywords

Application Security ExpertiseThreat Modeling LeadershipSAST/DAST/SCA Tooling ExperienceVulnerability Management OwnershipProduction-Quality Coding in TypeScript/JavaScript

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

TypeScriptJavaScriptGoPythonSASTDASTSCAThreat ModelingVulnerability ManagementSecure Coding

Soft Skills

Clear CommunicationInfluencing Without AuthorityMentoring

Tools & Technologies

CI/CDAI-Assisted Code AnalysisCloud PlatformSecurity Champions Program

Industry Keywords

OWASP Top 10API SecurityInjection FlawsSSRFCryptography MisusePenetration TestingSOC 2ISO 27001

Tech Stack

Tools & technologies

AWSCloudJavaScriptPythonTypeScriptGo

About the role

Key responsibilities & impact

Design and build Fingerprint's secure development lifecycle, including security requirements, threat modeling, secure code review, and pre-release security testing
Own and operate SAST, DAST, SCA/dependency scanning, secrets detection, and container/IaC scanning in CI/CD
Build AI-first security tooling for triage, auto-remediation, security review agents, and AI-augmented testing
Establish secure defaults, hardened libraries/frameworks, and reusable security patterns
Write code, security libraries, CI integrations, and automation in engineering repositories
Lead threat modeling and architecture security reviews across APIs, web/mobile SDKs, dashboards, and data pipelines
Run vulnerability management, including triage, risk rating, remediation, and SLAs
Partner with Compliance on penetration testing, retesting, and remediation
Perform hands-on security testing for authentication, authorization, APIs, injection, SSRF, business logic, and abuse paths
Lead application-layer security incident investigation, containment, root cause analysis, and remediation
Define application security logging and alerting with Cloud Platform and engineering teams
Support engineering through office hours, design consultations, secure coding guidance, and a Security Champions program
Develop and deliver secure coding training; mentor engineers through code review and design feedback
Partner with the Senior Manager, Application Security on the roadmap and own technical execution
Provide engineering evidence for security controls and support enterprise customer security conversations and vendor assessments

Requirements

What you’ll need

8+ years in software engineering and/or security engineering, with 5+ years focused on application security
Production-quality coding ability in TypeScript/JavaScript, Go, Python, or similar
Understanding of modern web and API architectures
Deep practical AppSec expertise, including OWASP Top 10, authentication and authorization, API security, injection, SSRF, cryptography misuse, business-logic, and abuse flaws
Experience leading threat modeling and design-time security reviews for complex systems
Experience deploying and tuning SAST/DAST/SCA/secrets-detection tooling in CI/CD
Experience running AI-assisted code analysis, triage, or auto-remediation in a real program; daily use of AI agents
Vulnerability management ownership, including triage, severity rating, remediation tracking, and penetration-test programs with SLAs
Track record of influencing engineering teams without authority
Clear written and verbal communication of technical risk
Must be authorized to work from the home location
Nice-to-have: fraud detection, bot mitigation, identity, or device intelligence experience
Nice-to-have: AWS cloud security, Wiz or equivalent CSPM, client-side/mobile SDK security, multi-tenant SaaS, bug bounty operations, AI/ML security, autonomous or AI-augmented penetration testing, security certifications, published research/CVEs/open-source contributions, and SOC 2/ISO 27001 controls experience

Benefits

Comp & perks

100% remote work
Globally distributed, remote-first team
Inclusive work environment
Opportunity to shape a dedicated AppSec function from its first days
Staff-level scope and autonomy
Modern security stack and tooling including Snyk, Wiz, Cloudflare, and Okta
Compliance, IT, and infrastructure owned by dedicated teams, allowing focus on engineering
Visa sponsorship is not provided