Senior Security Engineer - Application Security

Nasuni

3d•Remote

About The Position

Nasuni is seeking a Senior Security Engineer specializing in application security and penetration testing to protect its enterprise data infrastructure and SaaS products. The role identifies and validates vulnerabilities, conducts penetration tests, guides secure design decisions, and works with Engineering to remediate and retest findings across Nasuni products, Resilio, DryvIQ, cloud services, and emerging AI-enabled capabilities. This is a hands-on role involving independent execution of complex security assessments, coordination of assigned testing initiatives, and recommendations for risk-based priorities within established security standards. It combines technical judgment, practical automation, and cross-functional influence. The position is remote within the United States and reports to the Chief Information Security Officer. Nasuni describes success at 90 days as establishing findings, a testing environment, and remediation visibility; at six months as delivering risk-based internal testing and improving threat-modeling consistency; and at twelve months as coordinating the annual external assessment and demonstrating measurable remediation progress.

Requirements

Approximately 5 or more years of relevant security engineering experience, including substantial hands-on application security or penetration testing.
Demonstrated manual testing of web applications and APIs, including authentication and authorization issues.
Experience with threat modeling, secure code review, vulnerability validation, and remediation retesting.
Experience coordinating third-party penetration tests and reviewing technical findings.
Practical knowledge of OWASP guidance, security testing tools, and application security controls in the SDLC.
Ability to read code and automate tasks using a relevant programming or scripting language.
Working knowledge of cloud services, Linux, containers, or Kubernetes.
Effective technical communication.
Meaningful direct responsibility for application security assessments is expected; equivalent demonstrated expertise is valued.

Nice To Haves

Enterprise SaaS, hybrid-cloud, or appliance security experience.
Experience with SBOM, CycloneDX/SPDX, supply-chain security, and CI/CD tooling.
Experience testing LLM or agentic features, conducting M&A assessments, or preparing audit evidence.
OSCP, GWAPT, GPEN, GWEB, CSSLP, or equivalent demonstrated skills.
A related degree or equivalent practical experience.

Responsibilities

Conduct threat modeling, secure design reviews, and targeted code reviews for web applications, APIs, cloud services, and appliances.
Perform manual and tool-assisted penetration testing, document reproducible findings, and verify fixes.
Coordinate external penetration-test scoping, execution, report quality review, remediation tracking, and retesting.
Validate customer-reported vulnerabilities and advise Engineering on prioritization, mitigation, and closure.
Improve SAST, SCA, secrets detection, container scanning, and CI/CD security workflows with engineering partners.
Support SBOM and software supply-chain vulnerability impact analysis.
Assess AI-enabled product features for access-control weaknesses, prompt injection, and unintended data exposure.
Use approved AI-assisted tools for test planning, code analysis, and research; independently verify outputs and protect confidential data.
Share practical security guidance and improve repeatable assessment processes.