Senior Application Security Engineer, Athelas

• 5+ years of hands-on application security or software engineering experience, not mainly audit or compliance work
• Genuine engineering depth: you can read and reason about code well enough to find real bugs and root causes
• Strong AppSec fundamentals: threat modeling, secure code review, and OWASP-aligned vulnerability knowledge
• Comfort operating independently with good judgment in a fast-moving environment
• Clear communication that earns trust with engineers

Desirable

• We're looking for an Application Security Engineer who combines real engineering depth with security fundamentals — someone who gets into the code, spots systemic patterns, and builds the tooling and fixes that address them at scale, rather than flagging issues for someone else to resolve
• This isn't an audit-from-a-distance role. You'll work directly with engineering, with no interim layer needed, and you'll be equally comfortable owning a project end-to-end as you are looping in support when it counts
• Identify systemic security gaps in our codebase and engineering workflows, and drive durable fixes with engineering, not just one-off patches
• Build security tooling and automation, including SAST/SCA integration and custom checks, that catches issues earlier rather than after they ship
• Conduct code reviews and security design reviews for major product initiatives, including agentic AI systems and data pipelines
• Drive threat modeling for new features and translate requirements into guidance engineers actually use
• Think through what AI-accelerated development means for how we find, prioritize, and fix risk, and use AI tooling where it genuinely helps
• Present our security posture to enterprise customers, including healthcare and regulated-data conversations