Senior Software Engineer, Security

VTS•New York, NY

1d•$160,000 - $200,000•Onsite

About The Position

VTS is seeking a Senior Engineer to strengthen security across its applications, cloud infrastructure, and platform. The role focuses on proactively finding and closing exposures, engineering detection, investigation, and response capabilities, and developing AI-augmented defenses to reduce the time between vulnerability disclosure and exploitation. The position connects code-level investigation with enterprise-wide risk reduction, helping ensure the software supply chain, cloud infrastructure, and applications are resilient by design. The engineer will own the end-to-end SAST/DAST program and integrate analysis tooling into CI/CD; identify and build AI/LLM-driven security agents across supply-chain analysis, code review, and runtime behavior; investigate and resolve incidents through root-cause analysis, remediation, and post-mortems; and lead vulnerability management and threat modeling. The role also partners with legal, IT, and leadership on SOC 2 Type II, ISO 27001, information security, and customer security requirements, while mentoring engineers and influencing product teams on secure development. The role requires deep technical investigation skills, including the ability to read systems-level code critically, alongside knowledge of secure design, secrets management, API security, system hardening, and compliance frameworks. The engineer operates autonomously against priorities set with their team lead and is expected to identify and raise security gaps proactively. This position is based in New York, NY, and requires working from the office four days per week.

Requirements

At least 8 years of experience in Security Engineering, AppSec, Vulnerability Research, or Incident Response.
At least 2 years in a senior-level capacity driving cross-team initiatives.
Ability to write in a systems-level language such as C, C++, Rust, Go, or ASM, and critically read systems and application code.
Hands-on experience with secrets management such as Vault, AWS KMS, AWS Secrets Manager, or similar.
Experience with secure API design, including authentication and authorization, input validation, and rate limiting.
Knowledge of system-hardening standards and tools such as CIS Benchmarks and SELinux/AppArmor.
Comfort operating within SOC 2, ISO 27001, or similar compliance frameworks and satisfying audit controls without over-engineering systems.
Ability to investigate issues from initial exposure through root cause and closure, using a measured approach.
Ability to work autonomously, execute priorities, and proactively identify and raise gaps.
Position requires working from the New York City office four days a week.

Nice To Haves

Knowledge of AI/LLM-based security defense and the ability to distinguish practical security applications from hype.
Familiarity with security research published through sources such as Arxiv and ACM.
Ability to investigate compiled code using a disassembler.
Experience with programming languages and ecosystems such as Ruby, Node.js, Java, TypeScript, and Python.

Responsibilities

Own, select, tune, and integrate the SAST/DAST program and tooling into the CI/CD pipeline.
Identify and build AI/LLM-driven defense agents for dependency and supply-chain analysis, code-level review, and runtime behavior.
Own security incidents end-to-end, from initial signal through root-cause analysis, remediation, and post-mortem.
Lead vulnerability management and threat modeling across internal and external environments, prioritizing based on exploitability and business impact.
Partner with legal, IT, and leadership to maintain and mature compliance posture, including SOC 2 Type II, ISO 27001, information security, and customer security questionnaires.
Mentor engineers and influence cross-functional product teams on secure coding, threat modeling, and security-first development.
Serve as a high-level escalation point for complex security incidents and conduct post-mortems that drive structural improvements.
Stay current with security research and evolving attack techniques, reassessing and rebuilding approaches when needed.
Apply secure-by-design practices, including secrets management, secure API design, and system hardening.
Proactively identify security gaps, raise them with the team lead, and work to prioritize and address them.