Senior Application Security Engineer

Apollo.io

19h•$190,100 - $273,200

About The Position

The Senior Application Security Engineer is a senior individual contributor responsible for strengthening Apollo’s secure software development lifecycle and reducing application risk across product, platform, and AI-powered features. The role combines code-level application security work with cross-functional partnership, including application security reviews, threat modeling, AppSec tooling, findings triage and remediation, external testing intake, and developer enablement. Calibrated at the L6 senior-IC level, the role owns semi-annual or annual goals, solves ambiguous problems using sound judgment, improves operational processes, and drives cross-team collaboration and influence. It works with Engineering, Product, IT, Platform, Data, Legal, and other security teams to embed security into design, implementation, and deployment, and to keep security priorities aligned with business risk and product velocity.

Requirements

At least 5 years of software engineering or application security experience, with meaningful hands-on AppSec depth in modern SaaS environments.
Strong software development skills and ability to read, write, and ship production code.
Deep familiarity with common application security issues, secure design, authentication and authorization patterns, vulnerability management, and developer security tooling.
Ability to perform deep code review, penetration testing, and exploit-oriented validation, and to fix vulnerabilities directly or work closely with engineers on durable remediations that withstand bypass attempts and variant analysis.
Experience managing findings from bug bounty, penetration tests, internal reviews, or automated security tooling through closure and verification.
Experience using AI-assisted tools, automations, APIs, or structured workflows to improve engineering or security processes at scale.
Experience securing AI-powered systems or features, including AI API exposure, prompt and response handling, data protection, misuse scenarios, and monitoring expectations.
Strong written and verbal communication, stakeholder management, and influencing skills across technical and non-technical partners.

Nice To Haves

Ruby experience; Python or similar scripting ability is also a plus.
Experience with Linux and cloud fundamentals, ideally in GCP-backed environments.
Experience supporting or leading security reviews for AI-native products, internal agents, or AI-assisted engineering workflows.
Experience improving secure-by-design practices and AppSec observability in a fast-moving engineering organization.
Experience with security training, developer enablement, or security champions programs.
Relevant security certifications.

Responsibilities

Own and continuously improve the secure software development lifecycle for Apollo applications, embedding security into design, implementation, and deployment.
Perform application security reviews, threat modeling, and deep code-level analysis for high-impact product, platform, and AI features before launch.
Provide practical security architecture guidance to Engineering, Product, and IT teams.
Help define and maintain application-security guardrails, secure design expectations, code review standards, and risk models for new and existing systems.
Manage vulnerabilities from internal reviews, bug bounty, penetration tests, SCA/runtime findings, and other research signals; validate, prioritize, route, track, and verify remediation within SLAs.
Analyze vulnerability root causes, propose safe fixes, and directly implement or support remediation for complex vulnerabilities.
Perform hands-on application security validation and offensive testing, including exploit development, bypass testing, adversarial analysis, and focused red-team-style exercises.
Make risk-based severity decisions using exploitability, data sensitivity, customer impact, and blast radius.
Configure and improve AppSec tooling and integrations, including SAST configuration, ignore lists, dashboards, and other controls.
Select, build, or refine security tools, automations, and workflow enhancements to reduce manual effort and scale AppSec operations.
Use AI to improve security and engineering processes where it materially improves speed, consistency, or signal quality, validating outputs with engineering judgment.
Embed AI-specific security checks into SSDLC reviews and code analysis, covering input and output handling, AI-exposed APIs, prompt and response guardrails, abuse, and data-exfiltration paths.
Partner on AI security requirements and controls so AI systems and AI-powered features are securely designed, deployed, and operated.
Support security enablement for engineers and security champions through secure coding, AppSec, and AI-safety content.
Provide actionable remediation guidance, secure patterns, and examples that help engineering teams resolve issues correctly.
Partner with Engineering, Product, Platform, Data, Legal, and other security teams to align AppSec priorities with business risk and product velocity.
Produce clear documentation, metrics, and written narratives to improve AppSec visibility, observability, and decision-making.
Own meaningful AppSec goals over semi-annual or annual horizons, independently identifying solutions to ambiguous problems and driving cross-team operational improvements.