Sr. Application Security Engineer

Pax8

7d • $140,000 - $160,000 • Remote

About The Position

Pax8 is hiring a Senior Application Security Engineer to help secure its cloud marketplace, financial platforms, and agentic AI products. The role is part of a small, collaborative remote Platform Security team and partners directly with engineering leaders and architects to influence secure product design and delivery. It combines hands-on application-security work with opportunities to build AI-enabled security tooling, with sound security judgment and human oversight remaining central.

The engineer will serve as a trusted security partner to product teams, lead threat modeling, conduct code and design reviews and security testing, and own vulnerability triage and remediation support. They will improve security tooling and developer workflows, develop automation for vulnerability management, help establish guardrails for AI-assisted development, and advise on architectural risks and tradeoffs. The role also includes mentoring, supporting security champions, and assisting with penetration-testing findings, bug bounty triage, and security incidents as needed.

The position is remote in the United States and requires valid U.S. work authorization. Compensation is $140,000–$160,000. The application deadline is November 30, 2026.

Requirements

• Substantial application or product security experience and a track record of partnering directly with software engineering teams.
• Deep practical capability in threat modeling and manual code review for web and microservice environments.
• Strong understanding of authorization, multi-tenant isolation, and business-logic vulnerabilities.
• Hands-on experience operating source-code analysis, dependency analysis, dynamic testing, and secret-detection tools, including configuration, tuning, pipeline integration, and finding triage.
• Ability to distinguish noisy security findings from exploitable risks and clearly explain remediation.
• Experience creating automation or engineering tooling for vulnerability management.
• Practical understanding of security risks in large language model and agentic applications, including prompt injection, unauthorized tool use, and possible data-exfiltration paths.
• Proficiency in at least one modern cloud-native programming language and comfort reading unfamiliar code; the environment includes Kotlin and JavaScript/TypeScript.
• Working knowledge of Amazon Web Services, Kubernetes, containers, and infrastructure as code.
• Ability to challenge designs constructively, explain tradeoffs, and collaborate with engineers toward solutions.
• Valid right to work in the United States.

Nice To Haves

• Experience applying large language models or agents to security workflows.
• Experience securing agentic applications or Model Context Protocol integrations.
• Experience with identity and authorization in multi-tenant software-as-a-service environments.
• Experience securing transactional and financial systems.

Responsibilities

• Partner with product teams, engineering leads, and architects to influence secure design and implementation.
• Lead practical threat modeling and translate risk into actionable engineering decisions.
• Conduct manual code reviews, design reviews, and security testing beyond automated findings.
• Own the vulnerability lifecycle, assessing and prioritizing findings from SAST, SCA, DAST, and secret-scanning tools.
• Configure, tune, and maintain security tooling in delivery pipelines and bring security insights into developer workflows.
• Create agentic tooling to improve vulnerability triage, deduplication, exploitability enrichment, and remediation guidance while maintaining human oversight.
• Shape and validate guardrails for AI-assisted and agent-generated code.
• Partner with engineering teams to reproduce vulnerabilities, plan remediation, and validate fixes.
• Represent security in architectural decisions and explain technical risks, tradeoffs, and practical paths forward.
• Mentor teammates and engineering security champions, and turn recurring defects into focused learning.
• Support penetration-testing findings, bug bounty triage, and security incidents when application-security expertise is needed.

Benefits

• 401(k) with company match
• Medical, dental, and vision coverage
• Employee Assistance Program (EAP)
• Employer-paid life, AD&D, short-term disability, and long-term disability insurance
• Flexible open PTO
• Paid sick leave
• Paid parental leave
• RTD EcoPass for eligible Colorado-based employees
• Access to an internal development hub, Learning & Development trainers, AI-powered tools, mentors, and cross-continent collaboration

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed