Application Security Engineer

VGS

. Partner across Security and Engineering to build a friction-free, developer-centric security program .

Posted 10/12/2026full-timeUnited StatesMid-LevelSenior💰 $175,000 - $230,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in Application Security and full stack development, with a strong focus on integrating security practices into the software development lifecycle. Proficient in secure coding assessments, threat modeling, and managing bug bounty programs while fostering collaboration across engineering teams.

Highest-signal resume keywords

Application SecuritySecure SDLCSAST/DAST Tool IntegrationThreat Modeling (STRIDE)Bug Bounty Program Management

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

JavaPythonSecure Code AssessmentsVulnerability IdentificationCI/CD PipelinesTechnical BloggingCode ReviewsSecurity Training

Soft Skills

Exceptional CommunicationBuilding Trust

Tools & Technologies

GitHub Advanced SecurityZAPBURPSynopsysVeracodeSemgrepAWS Security Controls

Industry Keywords

FintechCloud-NativeHigh-GrowthPre-IPO

Tech Stack

Tools & technologies

AWSCloudJavaMicroservicesPythonSDLC

About the role

Key responsibilities & impact

Partner across Security and Engineering to build a friction-free, developer-centric security program
Shape the Secure SDLC
Integrate SAST, DAST, and SCA tooling into GitHub/GitLab CI/CD pipelines to identify vulnerabilities before production
Design, communicate, and maintain developer-friendly SDLC processes, frameworks, and STRIDE-based threat-modeling practices
Lead the private bug bounty program, including spend tracking, report triage, and reducing Mean Time to Mitigation
Deliver secure coding training and cultivate a Security Champions network across Engineering
Conduct threat models and code reviews for Java and Python microservices
Author technical blogs, manage vulnerability disclosures, and showcase VGS security engineering with external communications

Requirements

What you’ll need

3–5+ years of dedicated experience in Application Security and/or full stack development
Practical background conducting secure code assessments for Java and Python applications
Deep familiarity integrating SAST/DAST tools, including GitHub Advanced Security, ZAP/BURP, Synopsys/Veracode, Semgrep, and similar tools, into modern CI/CD systems
Hands-on experience operating bug bounty programs and setting program metrics/KPIs
Practical experience applying threat-modeling frameworks such as STRIDE to complex systems
Exceptional communication skills with a track record of building trust across engineering teams
BA/BS degree (nice to have)
Prior experience in cloud-native, high-growth, or pre-IPO fintech startups (nice to have)
Hands-on experience with AWS security controls and cloud infrastructure (nice to have)
Comfortable navigating fully remote, globally distributed work environments (nice to have)

Benefits

Comp & perks

Competitive salary
401(k) with a 4% match and immediate vesting (applies to US only)
Early equity
Internet stipend
Learning stipend
Office set-up stipend (applies to US only)
Insurance (medical, dental, and vision)
HSA/FSA options
Life and disability insurance
Pet insurance
Flexible PTO
Paid national holidays
Global parental leave program
Promote from within
Lunch and learns
Team events and summits
Remote and hybrid opportunities
Flexible working hours
Weekly office lunches
Employee discount platform