Senior Application Security Engineer

Description

The company is the team behind the PlayStation brand and a subsidiary of Sony Group Corporation. It delivers hardware and network services to more than 100 million people and owns some of the best-known entertainment properties in the world.

The team builds and grows the experiences under that brand. The role sits within Product Security as a senior technical leader who guides practices and influences several teams to build security into the software development lifecycle.

You will mentor and support the team with hands-on design, implementation and testing of secure solutions for the company's products and services. You will work with new technology, engineers and a security team that pushes the limits of the gaming industry.

Responsibilities

• Drive security initiatives across the SDLC and improve development practices with scalable automation.
• Run and guide threat modeling and security requirements early in design.
• Work with developers, architects and product managers to match business goals to security needs.
• Lead security architecture and code reviews for distributed systems.
• Test hands-on to find risks, then drive fixes with vulnerability and incident response teams.
• Build out the Product Security strategy through cross-functional projects and cultural influence.
• Weigh business risk against security risk and give practical, technically sound advice.
• Turn lessons learned into reusable assets that strengthen the overall security posture.
• Coach engineers and practitioners to think secure-by-default and share accountability.
• Coordinate teams to deliver measurable security and business results.

Requirements

• You bring 7+ years in information security and 3+ years in software development.
• You hold a bachelor's degree or equivalent in Computer Science, Information Security or a related field.
• You communicate and lead well and can persuade technical and non-technical colleagues, including managers.
• You are self-driven and proactive, spotting opportunities and leading work on your own.
• You understand enterprise and cloud-native architectures and how to design them securely.
• You know network and web protocols such as TCP/IP, TLS, HTTPS, OAuth 2.0 and OpenID Connect, along with common attack vectors.
• You have a proven record guiding secure development and code reviews and giving risk-based, actionable advice.
• You program in several languages such as Java, C/C++, JavaScript and Python and can fix flaws like those in the OWASP Top 10.
• You have integrated SAST, DAST and dependency scanning into CI/CD pipelines.
• You are familiar with Agile, DevOps and modern delivery practices.
• You have hands-on cloud experience with AWS, Azure, GCP, Kubernetes, service mesh and CDN, including secure configuration and identity management.
• Desired: strong analytical and problem-solving skills with an attacker's mindset, able to anticipate and simulate real attacks.
• Desired: experience in penetration testing, automated testing or test frameworks such as JUnit, pytest, REST Assured and Playwright.
• Preferred: security certifications such as GIAC, OSCP, CEH, CISSP, CCSP or equivalent.

Conditions

The role can be remote, and pay ranges vary by location. For Seattle, the estimated base pay range is $177,300 - $265,900 USD.

Base pay is set from market benchmarks and location and may vary under the hybrid working policy. Individual pay depends on job-related factors such as knowledge, skills, experience and location.

Background checks are run at the offer stage for all new hires, and some roles include criminal checks. Personal information is processed for these checks.

Benefits

• Top-tier benefits including medical, dental and vision cover, a matching 401(k), paid time off, a wellness program and employee discounts on the parent company's products.
• The role may also be eligible for a bonus package.