Application Security Engineer

Nintendo•Redmond, WA

5d•$108,450 - $173,550•Hybrid

About The Position

This role is part of Nintendo of America’s IT: Information Security department and provides hands-on application and AI security engineering for enterprise applications, APIs, cloud services, and AI-enabled solutions. The engineer partners with developers to assess risk, improve secure designs, and build automated security capabilities across the software development lifecycle. The role performs application security assessments, threat modeling, architecture and code reviews, evaluates application controls, and supports incident investigation and remediation. It also assesses AI-enabled applications and integrations, helps mitigate AI-specific threats, and establishes security review criteria for AI use cases in alignment with governance processes and frameworks. The engineer builds and integrates security testing into CI/CD pipelines and developer workflows, develops scripts and tools to streamline security processes, maintains security solutions, evaluates new technologies, and ensures work aligns with compliance requirements and internal controls. The position is hybrid in Redmond, Washington, with regular onsite work required; it is not open to fully remote status.

Requirements

At least five years of related experience in application security, security engineering, software engineering, or a related technical security discipline.
Experience with application assessments, threat modeling, architecture reviews, secure code reviews, and common application vulnerabilities and defenses.
Understanding of web applications, APIs, cloud services, authentication, authorization, secrets management, and data protection.
Ability to read application code.
Experience with security testing tools, CI/CD pipelines, and automated security checks.
Strong communication skills, including the ability to translate technical risks into clear recommendations for technical and non-technical audiences.
Foundational understanding of generative AI, LLM-enabled applications, and related security risks, or demonstrated ability to develop that knowledge quickly.
Undergraduate degree in Computer Science, Cybersecurity, Software Engineering, or a related field, or an equivalent combination of education and experience.
Must be legally eligible to work in the United States; visa sponsorship is not available.

Nice To Haves

Experience with cloud platforms such as AWS, API penetration testing, microservices, and containers such as Kubernetes in multi-team enterprise environments.
Familiarity with AI risk and governance frameworks and common AI threats, such as prompt injection, data leakage, model or supply chain compromise, and misuse of autonomous agents.
Practical AI security experience.
Experience with Python or another scripting language.

Responsibilities

Perform security assessments, threat modeling, architecture reviews, and secure code reviews for enterprise applications, APIs, and cloud services.
Evaluate authentication, authorization, data protection, secrets management, and other application controls; partner with developers to prioritize and validate remediation.
Develop reusable secure design patterns and provide practical secure coding guidance throughout the software development lifecycle.
Support the investigation and remediation of application and API security incidents.
Assess AI-enabled applications, including LLMs, RAG, agents, connected tools, and MCP integrations.
Identify and help mitigate prompt injection, sensitive information disclosure, insecure output handling, excessive permissions, and unsafe tool use.
Partner with application, cloud, and AI teams to implement least privilege, data protection, security testing, and technical guardrails.
Establish security review criteria for new AI use cases, including data classification and handling, model and vendor risk, and approval conditions aligned with AI governance processes and frameworks.
Review identity, access, and logging for AI agents, service accounts, and connected tools so agent actions are authorized, observable, and auditable.
Partner with peer security engineers to define detection and response for AI-related threats.
Build and integrate security testing into CI/CD pipelines and developer workflows, including static and dynamic testing, dependency analysis, secrets detection, and API testing.
Develop scripts, tools, and integrations to streamline vulnerability analysis, remediation tracking, and repeatable security processes; evaluate responsible uses of AI to improve these capabilities.
Maintain and troubleshoot security solutions, evaluate new technologies, and ensure work aligns with established compliance requirements and internal controls.