Application Security Engineer

Description

The company builds software that helps finance teams work faster, with clearer information and more confidence. Its teams are spread across several continents and time zones.

The Information Security team is hiring an Application Security Engineer to help protect the company's platform. The work covers reviewing results from security scanning tools, helping engineers fix what matters most, and joining design reviews and threat modelling for new features throughout the development lifecycle. You will also apply automation and AI-assisted tools to routine tasks like sorting and summarizing results, so the team can spend more time on serious problems.

The ideal person has software engineering and security experience, solid secure development habits, and hands-on familiarity with SAST, SCA, and DAST tools. You care about protecting customers through the platform. You are eager to learn, work well with people at every level, and take a practical approach that keeps delivery on track. You must be able to explain technical issues clearly to both technical and non-technical people.

Want to learn more first? Visit the company's careers site to read about its people, culture, and benefits.

Responsibilities

• Review results from SAST, SCA, and DAST tools, confirm which ones are real, and rank them by how easily they can be exploited and how much risk they pose.
• Work with development and engineering teams to fix vulnerabilities, giving them clear and workable advice.
• Take part in architecture reviews and threat modelling for new features and services.
• Tune application security tools and build them into CI/CD pipelines so checks fit into how developers already work.
• Use AI-assisted tools and automation to handle repetitive work such as summarizing results, removing duplicates and false positives, opening tickets, and writing reports.
• Write scripts and lightweight tools that automate recurring security tasks.
• Examine the SDLC and software supply chain, including third-party dependencies, to find ways to strengthen security.
• Manually test findings when needed to confirm their actual impact.
• Track fixes in progress, and record and report security issues and trends.
• Help write secure development guidance and standards, and teach developers about security.
• Share findings with other Security team members to improve the overall security posture.

Requirements

• Bachelor's degree (BSc or BA) in computer science, engineering, or a related field, plus 5+ years of experience in application security, software development, or DevSecOps.
• Or a master's degree (MSc or MA) in computer science, engineering, or a related field, plus 1+ year of experience in application security, software development, or DevSecOps.
• Or an associate degree in computer science, engineering, or a related field, plus 5+ years of experience in application security, software development, or DevSecOps.
• Ability to triage and rank security findings by exploitability and business impact.
• Working knowledge of SAST, SCA, and DAST tools.
• Understanding of secure design principles, with the ability to contribute to architecture reviews and threat modelling.
• Clear, pragmatic judgement about fitting security into existing team workflows.
• Strong communication skills, comfortable speaking with all levels of management.
• Organized, with solid reasoning and judgement, and able to juggle several projects at once.
• Self-motivated and eager to learn.
• Preferred: experience writing or reviewing C and.NET code, a bonus.
• Preferred: a software development background, with knowledge of secure coding and common vulnerability classes such as the OWASP Top 10.
• Preferred: hands-on experience with SAST, SCA, or DAST tools and triaging their output.
• Preferred: experience using AI tools or LLMs to automate repetitive security work, such as reviewing findings, summarizing results, or drafting remediation guidance.
• Preferred: experience with CI/CD pipelines and DevSecOps practices.
• Preferred: scripting or automation experience, for example in Python or PowerShell.
• Preferred: familiarity with threat modelling methods such as STRIDE.
• Preferred: exposure to Burp Suite or similar tools for validating web application findings.
• Preferred: familiarity with security risk management, SOC2, FedRAMP, security policies and procedures, or security audits.
• Preferred: industry-recognized certifications such as CompTIA Security+, CSSLP, GSSP-.NET, or other application security or secure development certifications.
• Prior experience with the company's own product is not required. Experience with any financial consolidation package is a plus.

Conditions

This is a remote role.

Gross annual base salary is $114,000 to $148,000 USD.

Total compensation depends on experience, skills, and location, judged on objective, job-related criteria. Additional variable pay and benefits may apply.

You must be legally authorized to work in the country where the role is based, without sponsorship.

Benefits

• Medical plan
• Dental and vision insurance
• Life insurance
• Short- and long-term disability coverage
• Vacation time
• Paid holidays
• Professional development support
• Retirement plan