Sr. Application Security Engineer

Extra Space Storage • Salt Lake City, UT

1d • Hybrid

About The Position

As a Sr. Application Security Engineer at Extra Space, you will be a trusted security partner embedded in how engineering teams design, build, and ship software. You will work across the Product Engineering organization with principal and staff engineers, the cybersecurity team, and security champions on each engineering team to build security in from the start. Applications run on AWS and Vercel and are built primarily with C# .NET, TypeScript, and React/Next.js, supported by SQL Server and other relational and non-relational databases.

This is a hybrid role requiring work at the Cottonwood Heights office in Salt Lake City two days per week. The company cannot provide work sponsorship, including OPT, STEM-OPT, or H-1B visa sponsorship.

Requirements

• 6 or more years of combined experience in software engineering, application security, product security, or a closely related field.
• Proficiency in most of the primary languages: C# .NET, TypeScript, JavaScript, and SQL.
• Experience securing web applications built on modern frameworks and cloud-native architectures, particularly AWS.
• Hands-on white-box testing and secure code review experience.
• Strong understanding of SSDLC principles and experience implementing or maturing secure development programs.
• Solid understanding of common vulnerabilities and attack techniques, including OWASP Top 10, API security, and authentication and authorization flaws.
• Experience integrating security tooling into delivery pipelines such as GitHub, TeamCity, or similar.
• Familiarity with AI security risks and emerging attack surfaces, including agentic systems, MCP, and LLM-powered workflows.
• Risk-focused mindset and ability to explain security risk in business terms, weigh it against business needs and risk tolerance, and guide pragmatic decisions.
• Proven ability to build trusted relationships with engineering teams and guide behavior without direct authority.
• Strong written and verbal communication skills, with comfort in design reviews with engineers and risk conversations with leadership.

Nice To Haves

• Development experience with Next.js, Vercel, or serverless architectures.
• Practical knowledge of security frameworks and standards such as OWASP ASVS, NIST 800-53, CIS v8, PCI DSS, or SOX.
• Hands-on security certifications such as OSCP, BSCP, GWEB, PNPT, or similar.
• Experience running or triaging a bug bounty program.
• Bachelor's degree in Computer Science, Information Security, or a related field.

Responsibilities

• Conduct security architecture and design reviews for new and evolving features, identify risks early, and recommend practical mitigations.
• Perform threat modeling and manual and automated code reviews, and partner with developers to prioritize and remediate findings.
• Drive a risk-based approach to application security and help teams understand vulnerabilities in terms of business impact.
• Mature the Secure SDLC, including secure coding standards, security requirements, and automated checks such as SAST, DAST, SCA, and secrets scanning in CI/CD pipelines.
• Build and maintain security tooling and automation that scales across teams, focusing on reducing risk rather than adding tools.
• Lead and grow the security champions program and train champions so each team has security expertise nearby.
• Serve as the application security subject matter expert for engineering, product, and leadership, and mentor engineers on secure development practices.
• Ensure AI tools and AI-powered features are adopted within acceptable risk limits.
• Align applications with SOC 1, SOX, CIS v8, and PCI DSS (SAQ-A, SAQ-P2PE), and support audits with evidence and remediation plans.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed