Senior Application Security Engineer

Tatari•San Francisco, CA

2d•Hybrid

About The Position

Tatari is seeking its first dedicated Application Security Engineer to define the security architecture for all shipped products. This role involves working directly with Engineering teams to identify vulnerabilities, design mitigations, and develop tooling and automation to promote secure development practices. The engineer will report to the Head of Security and be a key technical contributor to Tatari's Security program. The ideal candidate writes production-quality code, thinks like an attacker, and can effectively guide engineers.

Requirements

Production Python experience with the engineering depth to review code meaningfully and build security tooling; Java or Rust is a bonus
Significant hands-on application security experience, ideally at a SaaS company, including working knowledge of established standards (OWASP Top 10, API Security Top 10, ASVS, SPVS, AISVS) and how common vulnerability classes manifest in production systems
Threat modeling experience with Product and Engineering teams
Experience building security tooling or automation (scripts, pipelines, libraries)
Familiarity with AWS and Kubernetes security controls as they relate to application-layer risks
Working knowledge of how LLMs introduce new attack surfaces and how to mitigate them, with practical experience using AI tools in security or engineering workflows
Demonstrated experience reviewing API designs and implementations for auth anti-patterns, token mismanagement, injection risks, and sensitive data exposure
Track record embedding with Engineering teams: code review, design consultation, and standards definition
Experience building or maturing an AppSec program where coverage, tooling, or process needed to be defined from scratch

Responsibilities

Design and execute greenfield AppSec initiatives across Tatari's SaaS platform from threat modeling to remediation
Build and maintain security automation integrated into CI/CD pipelines and manage software supply chain risk
Own container security across build and runtime
Develop internal tooling and libraries that make secure coding easier for application engineers
Own SAST/DAST/SCA tooling: selection, tuning, CI/CD integration, and triage
Conduct application security reviews and threat models for new features and architectural changes
Identify and remediate vulnerabilities across APIs, services, and data pipelines
Partner with Engineering teams to establish secure coding standards and provide hands-on guidance
Assess and mitigate LLM-introduced risks in product features
Integrate agentic tooling into AppSec workflows to reduce toil
Contribute to security incident response when application-layer issues are involved