Senior Application Security Engineer, Upstart

• 3+ years of experience in an application security or security engineering-focused role
• An IT/CS degree or equivalent knowledge
• Experience in Java, Python or Ruby development
• Knowledge of industry standard authentication and authorization protocols (TLS, SAML, etc)
• Previous usage or knowledge of SAST/DAST and vulnerability scanners
• Understanding of Full Stack Development, SDLC, and CI/CD pipelines
• Understanding of network stack and common protocols
• A self-starter who is comfortable getting hands-on and engaging in all areas of product security, from ideation to deployment
• Ability to collaborate cross-functionally and communicate effectively with highly technical teams

Desirable

• We’re looking for a Senior Application Security Engineer to join our growing Information Security team
• Your primary function will be to work with Upstart’s engineering and product management teams to ensure that our product platform is secure, safe and reliable
• You’ll have the latitude to touch every aspect of our security strategies, with the opportunity to specialize as the team grows
• As one of the key resources on the Security team, you will have significant influence over the design of Upstart's Security program
• This team operates on the East/West Coast time zones
• Work closely with our engineering and data science teams to securely design and implement new products and features, including the development and maintenance of threat models for high-risk functionality
• Set up a regular vulnerability scanning tools and manage remediation of identified issues
• Support teams with vulnerability remediation efforts, including the design of remediation strategies
• Assess the threat model for cloud native infrastructures and applications
• Identify and design company-wide security controls and solutions
• Operate as an integral member of the engineering team and advocate for security best practices across the organization
• Help identify Upstart’s internal and external attack surface in a dynamic environment