Staff Application Security Engineer

Description

The company runs an AI-native platform for travel, serving more than 40,000 customers and nearly 2 million travelers, plus travel and AI companies that build on its infrastructure. One system supports business travel, group travel, human agents and AI agents.

The company has been recognised as TravelTech's Reservation Platform of the Year (2026), appeared on Inc.'s Power Partners list (2026), and was named to Built In's Best Places to Work list in each year from 2020 to 2026.

The team is looking for people who want to change how businesses plan and experience travel. Expect rapid growth, a demanding pace, full ownership of your work and colleagues who set a high bar.

The company is hiring a Staff Security Engineer to take primary ownership of the security and integrity of its applications and software systems. You will build a vulnerability management pipeline, run the application security program, and work with engineering teams to follow application security best practices, tackle difficult security fixes and keep the platform fast and secure.

You will work independently and sync regularly to keep quality and alignment across these areas:

Responsibilities

• Own the setup, tuning and running of the SIEM, investigate unusual threats and build alerts that catch incidents across layers.
• Run architecture, code and infrastructure configuration reviews, plus light penetration tests on web and mobile apps. Find root causes of vulnerabilities and fix them.
• Maintain and improve a vulnerability management CI/CD pipeline within the container and application delivery infrastructure. Apply proven methods to meet security and business goals, including when guidance is limited.
• Work with development and infrastructure teams to enforce secure coding and drive remediation. Adjust your communication to each team so security work moves forward.
• Build and maintain security frameworks and tools for the enterprise, and write security guidelines the wider engineering group can act on.
• Take a key part in incident response and forensic investigations, weighing context and data to decide well under pressure.
• Track the latest threats, give direct and clear guidance to development teams, and help build security training that raises the team's overall posture.

Requirements

• Strong skill in at least one programming language such as Ruby, Java, Python, C or Node.js.
• Experience running SIEM solutions and writing alerts that are targeted and efficient, cutting down noise.
• Strong working knowledge of Docker and Kubernetes, with hands-on automated container vulnerability management.
• Proficiency with SAST, DAST and IAST tools, and manual testing to confirm findings.
• Deep understanding of the OWASP Top 10, the MITRE Top 25 and secure coding practices.
• Ability to analyse complex, ambiguous problems, find root causes and give sound advice on hard security questions.
• A record of earning peers' trust through clear, direct communication, and a commitment to mentoring others.
• Experience with cloud security concepts and compliance frameworks such as SOC 2 and PCI.
• Applications are accepted until November 20, 2026, or until the role is filled. Applying early is encouraged, since review may start before the deadline.

Conditions

Pay depends on experience, expertise and location. Every role includes equity and a competitive base salary, and some roles also include an annual bonus. Your recruiter will share the full package during the process.

Base pay range: $182,800 to $215,000 USD.

The company works in a hybrid-hub model. You may work from an office or fully remote, and you will get the equipment and setup you need either way.

Perks and benefits can vary by employment type, location and other factors.

The company is an equal opportunity employer.

Benefits

• Equity for all employees.
• Competitive base pay based on role and experience. Some roles may also be eligible for bonuses or commissions.
• Benefits are listed in full on the company's culture page.