Senior Security Engineer, Application Security

Angi•Denver, CO

18h•$150,000 - $225,000•Remote

About The Position

Angi is seeking a Senior Security Engineer to own security architecture and execution across cloud infrastructure, applications, and emerging agentic AI products. The role spans cloud and application security, compliance controls, protection of applications from exploitation and abuse, and security architecture for AI agents with voice or chat, calendar, and account access. The position is remote, with applicants in Eastern or Central time zones preferred to align with the team's working hours. The engineer will collaborate directly with product and engineering teams, build tooling and frameworks that make secure development easier, mentor engineers, and participate in a 24/7 incident-response on-call rotation. The role also involves using and evaluating AI-assisted tools in InfoSec workflows.

Requirements

At least 5 years of experience in security engineering, spanning at least two of application security, cloud/infrastructure security, or enterprise security.
Hands-on experience with AWS and infrastructure as code, such as Terraform, CloudFormation, or equivalent.
Ability to read and contribute to product service code; preferred languages include Kotlin, NextJS, Python, Ruby, Scala, or Swift.
Sound build-versus-buy judgment, with the ability to use existing solutions or wrap, extend, or replace them when appropriate.
Fluency in the OWASP Top 10 and practical remediation approaches.
Fluency in authentication and authorization standards used at Angi, including OAuth, OIDC, and SAML.
Some exposure to LLM or agentic system security, including prompt injection, agent identity, and data exfiltration via AI systems.
Daily, fluent use of AI-assisted coding or security tools and the ability to explain how AI output is directed and verified.
Strong written communication skills for writing threat models and providing feedback on design documents and merge requests.
Comfort executing technical aspects of a compliance framework such as PCI, SOX, or similar, including vulnerability scanning, control reviews, and tamper detection.

Nice To Haves

Experience with static analysis tools such as Snyk, Veracode, or Fortify.
Experience with infrastructure vulnerability scanning tools such as Qualys, Tenable, or Rapid7.
Experience with penetration testing tools such as BurpSuite or OWASP ZAP.
Container and Kubernetes experience.

Responsibilities

Own security initiatives end to end across cloud infrastructure hardening and application security, including ambiguous work spanning multiple sprints.
Own technical controls retained by InfoSec within compliance frameworks such as PCI DSS, including ASV scanning, network security control reviews, and tamper-detection monitoring.
Deploy and tune infrastructure that protects Angi applications from exploitation, account takeover, and denial of service.
Drive security architecture and threat modeling for AI agent products, including voice and chat agents with calendar and account access.
Review RFCs, PRDs, and merge requests from a security perspective and partner with product and engineering teams on AI-native features.
Build tooling and frameworks that make secure development the easy path for engineers.
Mentor engineers across teams and improve recurring incident patterns, tooling gaps, and process debt.
Participate in all facets of the incident-response lifecycle through a 24/7 on-call rotation.
Evaluate and integrate AI-driven tooling into InfoSec workflows, using AI coding and security assistants daily.