Security Engineer

About the Role

The Dynamic Application Security Testing (DAST) team focuses on ensuring web applications, mobile applications, and APIs are secure by performing ethical hacking and penetration testing. This role operates at the intersection of cybersecurity and automation, building, maintaining, and supporting tools and automated processes to empower application teams to independently scan for, identify, and remediate OWASP Top 10 vulnerabilities. This role also leverages offensive security skills to support critical incident response and bug bounty programs.

Key Responsibilities

• Integrate dynamic analysis tools (OWASP ZAP, Burp Suite) into Jenkins and GitLab CI/CD pipelines for continuous security testing.
• Write and maintain custom automation scripts using Python, Java, and Bash to scale security efforts.
• Utilize AI to build new testing capabilities, streamline bug bounty submission triage, and troubleshoot code.
• Deploy, host, and maintain containerized security testing environments using Docker and AWS.
• Partner with engineering teams to guide them in identifying and remediating OWASP Top 10 vulnerabilities.
• Triage incoming bug bounty submissions and support critical incident response efforts.
• Perform ethical hacking and penetration testing against web applications, mobile apps, and APIs.

Requirements & Tech Stack

• Bachelor’s degree OR one or more years of work experience.
• 2+ years of hands-on experience in Application Security, Penetration Testing, or a DevSecOps engineering role.
• Deep understanding of web application architecture, APIs (REST/GraphQL), and mobile application security.
• Comprehensive knowledge of the OWASP Top 10, CWEs, CVSS scoring, and vulnerability validation/exploitation.
• Proficiency with dynamic analysis tools, specifically Burp Suite Professional and OWASP ZAP.
• Experience integrating security tools into CI/CD pipelines using Jenkins and GitLab CI.
• Strong ability to read, write, and maintain automation scripts in Python and Bash.
• Hands-on experience with Docker containers and deploying/managing applications in AWS (experience with EC2s/Linux is a plus).
• Ability to clearly explain complex security vulnerabilities to software engineers.
• Experience using AI assistants (ideally Gemini or Claude Code) for scripting, debugging code, or productivity improvements.

This is a remote role with occasional in-person trainings and meetings.