Senior Application Security Engineer, BioRender

• If you're excited by building developer-friendly security systems, solving meaningful engineering problems, and focusing on the threats that actually matter, we'd love to hear from you
• Demonstrable software engineering ability – you read code fluently, write production-quality code that engineers respect, and have contributed to real codebases (Node.js/React; Python a plus)
• Fluency using AI development tools (AI coding assistants, agentic workflows) to get the job done, and a clear-eyed view of the security risks they introduce
• Expertise in web application security and secure-coding best practices, and the ability to review code and application findings
• Experience integrating and maintaining SAST/DAST systems within CI/CD, and with Secure Software Development Life Cycles
• Hands-on experience securing cloud workloads on AWS and comfort with infrastructure-as-code (Terraform or equivalent); familiarity with Cloudflare a plus
• Threat-modeling experience and command of common code and network vulnerability types, their impact, and remediation
• Applied knowledge of cryptography, PKI, and TLS and their practical implementation

Desirable

• BioRender is seeking a Senior Application Security Engineer to join our Security team – an engineer first, who contributes directly to the codebase rather than managing security from the sidelines
• You'll help define how security is built into our engineering organization, contributing production code across our application (Node.js/React/Python) and infrastructure (Python, Terraform, AWS, Cloudflare) while shaping secure-by-design patterns, CI/CD automation, and engineering workflows that let the company move quickly and safely
• You'll work AI-natively, using AI coding assistants and agentic tooling to accelerate your own work while helping secure the AI-powered capabilities we're building
• Contribute production-quality code directly to the application (Node.js/React) and infrastructure (Python, Terraform) – you ship fixes and hardening yourself, not just findings for others to action
• Build and maintain security and CI/CD tooling for automation, keeping the secure path the default path
• Act as a security reviewer on RFCs and design documents, and pair with engineers to resolve issues at the source
• Define secure-by-design patterns and drive standards for authentication, authorization, and API security
• Lead threat modeling on new and existing systems and turn those models into shipped controls
• Own and evolve the Secure SDLC and CI/CD security integration (SAST/DAST/SCA/secrets) – tuned for high signal and low noise
• Work AI-natively: use AI coding assistants and agentic tooling to accelerate code review, triage, and tooling development
• Secure AI-integrated product features – reasoning about prompt injection, data leakage, and over-scoped tool, token, and data access
• Automate recurring security work so the team scales through leverage, not headcount
• Perform penetration testing and code reviews (Node.js/React) using OWASP methodology
• Drive identification and remediation of application security vulnerabilities (SAST/DAST/HackerOne)
• Own the bug bounty program end to end – issue evaluation, reproduction, and closing findings by shipping fixes