Staff Application Security Engineer, Fingerprint

• 8+ years in software engineering and/or security engineering, with 5+ years focused on application security — you've been the hands-on AppSec engineer at a product company, not a consultant or auditor passing through
• Strong software engineering foundation: You write production-quality code (TypeScript/JavaScript, Go, Python, or similar), understand modern web and API architectures, and are comfortable working inside engineering repositories and CI/CD pipelines
• Deep practical AppSec expertise: OWASP Top 10 and beyond — authentication and authorization design, API security, injection classes, SSRF, cryptography misuse, business-logic and abuse flaws. You can find these issues by hand, explain why they matter, and propose fixes engineers accept
• Threat modeling and security review experience: You've led design-time security reviews for complex systems and produced threat models that engineers used
• Security tooling program experience: You've deployed and tuned SAST/DAST/SCA/secrets-detection tooling in CI/CD and made it useful rather than noisy
• AI-native security tooling: You've run AI-assisted code analysis, triage, or auto-remediation in a real program — not a trial — and have earned opinions about where it's trustworthy, where it generates noise, and what should be allowed to block a merge. You use AI agents daily in your own security work
• Vulnerability management ownership: You've run triage, severity rating, remediation tracking, and pen-test programs with real SLAs
• Influence without authority: A track record of raising security outcomes across engineering teams through credibility, partnership, and good tooling — not mandates
• Clear communication: You write precise findings and design feedback, and you can explain technical risk to engineers, leadership, and customer security teams alike
• This is not a role for someone who wants to primarily write policy or manage a program from a distance. It's for an engineer who finds real bugs, builds real tooling, and earns the trust of other engineers by making their code better

Desirable

• Fingerprint's device intelligence platform processes billions of identification events for some of the world's most security-conscious companies — financial institutions, fraud prevention operators, and enterprises that rely on us to stop attackers
• That makes our own application security a product feature, not a back-office function: our customers' adversaries are, by definition, motivated to probe what we build
• As we scale with large enterprise customers, we're investing in application security as a dedicated, first-class engineering discipline
• Security is already part of how our teams build — scanning in the pipeline, a Cloud Platform team that treats security as a partner, and a mature compliance posture — and we're now standing up a focused AppSec function, led by a Senior Manager, Application Security who owns the program and strategy, to take it to the next level
• You will be the founding senior engineer of that function — the person who turns strategy into a working secure SDLC, finds and fixes what matters, and raises the security bar across engineering through technical depth, tooling, and influence
• This is a hands-on Staff role
• You will design, build, and operate — not just advise
• Design and build Fingerprint's secure development lifecycle: security requirements, threat modeling at design time, secure code review, and pre-release security testing — integrated into how engineers already work, not bolted on as a gate
• Own and operate the security tooling pipeline: SAST, DAST, SCA/dependency scanning, secrets detection, and container/IaC scanning (Snyk and equivalents) — tuned for signal over noise, integrated into CI/CD, with clear ownership and SLAs for findings
• Build the pipeline AI-first: AI-assisted triage and auto-remediation, security review agents that run inside the coding-agent loop and in CI, and AI-augmented testing — and decide, with evidence, what each is trusted to block, flag, or fix on its own
• Build paved-road security: secure defaults, hardened libraries and frameworks, reusable patterns (authn/authz, input validation, secrets handling, crypto) that make the secure path the easy path
• Write code. Contribute fixes, security libraries, CI integrations, and automation directly to engineering repositories
• Lead threat modeling and architecture security reviews for new products, features, and significant changes across the API, SDKs (web and mobile), dashboard, and data pipeline
• Run and mature the vulnerability management program: triage, risk-rate, and drive remediation of findings from scanners, pen tests, bug bounty, and customer reports — with clear severity standards and remediation SLAs
• Partner with the Compliance Lead, who runs the penetration testing program today, on scoping, retesting, and turning findings into engineering work — you bring the technical depth and own remediation
• Perform hands-on security testing of Fingerprint's platform — manual review and exploitation of authn/authz, API, injection, SSRF, business-logic, and abuse-path issues — with particular attention to the fraud and bot-detection threat surface where adversaries actively attempt to defeat the product
• Serve as the technical lead for application-layer security incidents: investigation, containment, root cause, and remediation — partnering with Cloud Platform on infrastructure incidents
• Define what application security logging and alerting should exist, and partner with Cloud Platform and engineering teams to get it built
• Act as the AppSec partner to engineering teams: office hours, design consultations, secure coding guidance, and a Security Champions program that scales your impact beyond one person
• Develop and deliver practical secure coding training grounded in Fingerprint's real codebase and real findings
• Mentor engineers in security thinking and raise the bar through code review and design feedback
• Partner with the Senior Manager, Application Security on the AppSec roadmap: bring technical findings, risk assessments, and recommendations that shape priorities; own execution of the technical program
• Provide the engineering evidence behind security controls when compliance needs it — you make the controls real; the compliance program is owned elsewhere
• Support enterprise customer security conversations with technical depth: questionnaires, architecture questions, pen test summaries, and due diligence calls with customer InfoSec teams
• Contribute to vendor security assessments where third-party code or integrations touch the platform
• This is the senior individual-contributor counterpart to the Senior Manager, Application Security. The manager owns the program, the strategy, and the team; you own the technical depth and the execution. The two roles are designed to work as a pair: you'll bring the findings, the engineering judgment, and the ground truth from inside the codebase, and together you'll decide what to prioritize
• As a Staff engineer, you are expected to operate with a high degree of independence — scoping ambiguous problems, setting technical direction for AppSec, and driving multi-quarter initiatives without needing day-to-day direction. As the founding engineer of a dedicated AppSec function, the patterns, tooling, and standards you establish will be the foundation the practice grows on
• Shape a dedicated AppSec function from its first days, with a manager and a mandate behind you — this investment is sponsored at the VP level and prioritized
• A security problem that actually matters: Fingerprint's customers use us to stop fraud and abuse. The adversaries are real, skilled, and motivated — the threat model here is more interesting than at most SaaS companies
• Modern stack and tooling already in place: Snyk, Wiz, Cloudflare, Okta, and a Cloud Platform team that treats security as a partner, not an obstacle
• Your time goes to engineering: Compliance, IT, and infrastructure are each owned by capable teams, so you spend your days on code, findings, and tooling — not evidence collection or ticket queues
• Staff-level scope and autonomy: You set the technical direction for application security at a company where security is a differentiator in enterprise sales