Senior Application Security Engineer

Sardine•,

1d•$135,000 - $180,000•Remote

About The Position

Sardine is hiring a Senior Application Security Engineer to strengthen application security across its financial crime and risk platform. The role focuses on identifying and preventing vulnerabilities—especially authorization flaws and business logic abuse—in services written in Go, Node.js, Python, Ruby, and Java and running across multi-cloud environments and Kubernetes. The engineer will run and automate the vulnerability management pipeline, triaging findings from scanners, code review, testing, threat modeling, penetration tests, and bug bounty reports. They will identify recurring root causes, establish secure patterns and defaults, create custom static analysis rules, review platform-layer controls, and partner with engineering teams to implement durable fixes. The work also includes hands-on application and API testing, manual review of high-exposure services, threat modeling, and security enablement across engineering, including a security champions program. Sardine is remote-first, and this position is listed as remote in the United States. Employees work remotely within the country in which they are hired and must maintain a home base there. Compensation depends on location. The company values ownership, sound judgment, evidence-based collaboration, and asynchronous influence across time zones.

Requirements

Experience running vulnerability management end to end and automating it with code against scanner, ticketing, and source-control APIs.
An engineering background that includes shipping and maintaining real software.
Ability to quickly understand unfamiliar code, review it rigorously, and reason about architecture and failure modes.
Ownership of problems through completion, including fixes that depend on other teams.
Code-auditing experience in at least one of Go, Python, Node.js, Ruby, or Java, and willingness to work in the other languages.
Practical command of the OWASP Top 10, with particular depth in broken access control and business logic flaws.
Experience with SAST, DAST, and SCA in CI/CD, tuned to produce output engineers trust.
Cloud fundamentals on GCP or AWS.
Experience with Docker and Kubernetes.
Ability to distinguish genuine security findings from theoretical ones.
Evidence-based, open collaboration, including willingness to update views when presented with better evidence.
Ability to influence asynchronously across time zones without relying on a reporting relationship.

Nice To Haves

Experience scaling security tooling across many repositories, languages, and build systems.
Experience writing custom static analysis rules with Semgrep, CodeQL, or similar tools.
Experience in fintech, payments, or other environments subject to serious third-party security review, such as PCI DSS, SOC 2, or customer audits.
Experience working in a fully distributed, asynchronous engineering environment.
Offensive security experience, including web, API, mobile, or cloud penetration testing; hardware and embedded security; physical security and lock sport; red team engagements; protocol and radio work; CTFs; or bug bounty results.
Advanced offensive security certifications, particularly OSWE or BSCP; CPTS, CRTO, or similar certifications also count.
Public work such as research, tooling, disclosures, or talks.

Responsibilities

Run the vulnerability management process end to end, including triaging, validating, routing, and driving remediation of findings from SAST, DAST, SCA, code review, penetration tests, and bug bounty.
Build automation using scanner, ticketing, and source-control APIs to reduce manual effort throughout vulnerability management.
Set scope for external penetration tests and the bug bounty program, direct testers, assess severity, and ensure findings are resolved.
Identify recurring vulnerability patterns and address their root causes rather than only fixing individual instances.
Establish secure patterns and defaults that make secure implementation the easiest option for engineers.
Write custom static analysis rules to detect organizational anti-patterns and prevent fixed bug classes from recurring.
Review platform-layer controls, including authorization, service identity, secrets handling, and gateway enforcement, and work with owning teams to close gaps.
Collaborate with engineers on practical fixes that are adopted and remain effective.
Conduct hands-on testing of applications and APIs, with emphasis on authorization and business logic.
Perform manual code reviews of high-exposure services.
Threat-model new and high-exposure designs.
Enable security across engineering, including through a security champions program.