Application Security Engineer

VGS

2d • $175,000 - $230,000 • Hybrid

About The Position

As an Application Security Engineer, you will partner directly across Security and Engineering to build a friction-free, developer-centric security program. You will shape our Secure SDLC, automate security guardrails in our CI/CD pipelines, scale our private bug bounty program, and foster a strong culture of security champions across a globally distributed team.

Automate Security Controls: Integrate proactive security tooling (SAST, DAST, SCA) directly into CI/CD pipelines (GitHub/GitLab) to catch vulnerabilities before code hits production.
Define & Drive Secure SDLC: Design, communicate, and maintain developer-friendly SDLC processes, frameworks, and threat modeling practices (e.g., STRIDE).
Manage Bug Bounty & Triage: Spearhead our private bug bounty program—tracking spends, triaging reports, and lowering Mean Time to Mitigation (MTTM).
Build Engineering Capability: Share best practices through secure coding training and cultivate a Security Champions network across Engineering.
Lead AppSec Reviews: Conduct threat models and code reviews for Java and Python microservices.
Amplify Security Culture: Partner with external communications to author technical blogs, manage vulnerability disclosures, and showcase VGS’s security engineering.

Requirements

• 3–5+ years of dedicated experience in Application Security and/or full stack development, with proven experience.
• Practical background conducting secure code assessments for Java and Python applications.
• Deep familiarity integrating SAST/DAST tools (e.g., GitHub Advanced Security, ZAP/BURP, Synopsys/Veracode, Semgrep and similar tools) into modern CI/CD systems.
• Hands-on experience operating bug bounty programs and setting program metrics/KPIs.
• Practical experience applying frameworks like STRIDE to complex systems.
• Exceptional communication skills with a track record of building trust across engineering teams.

Nice To Haves

• BA/BS degree
• A knack for out-of-the-box thinking that thrives in a fast-paced startup environment
• Prior experience in cloud-native, high-growth, or pre-IPO fintech startups.
• Hands-on experience with AWS security controls and cloud infrastructure.
• Comfortable navigating fully remote, globally distributed work environments.

Responsibilities

• Integrate proactive security tooling (SAST, DAST, SCA) directly into CI/CD pipelines (GitHub/GitLab) to catch vulnerabilities before code hits production.
• Design, communicate, and maintain developer-friendly SDLC processes, frameworks, and threat modeling practices (e.g., STRIDE).
• Spearhead our private bug bounty program—tracking spends, triaging reports, and lowering Mean Time to Mitigation (MTTM).
• Share best practices through secure coding training and cultivate a Security Champions network across Engineering.
• Conduct threat models and code reviews for Java and Python microservices.
• Partner with external communications to author technical blogs, manage vulnerability disclosures, and showcase VGS’s security engineering.

Benefits

• Competitive salary
• 401(k) with a 4% match and immediate vesting (applies to US only)
• Early equity
• Internet stipend
• Learning stipend
• Office set-up stipend (applies to US only)
• Insurance (medical, dental, and vision)
• HSA/FSA options
• Life and disability insurance
• Pet insurance
• Flexible PTO
• Paid national holidays
• Global parental leave program
• Promote from within
• Lunch and learns
• Team events and summits
• Remote and hybrid opportunities
• Flexible working hours
• Weekly office lunches
• Employee discount platform

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: Associate degree