Staff Application Security Engineer

Apollo.io

1d•$225,400 - $281,800

About The Position

The Staff Application Security Engineer leads application security strategy for Apollo’s Security department and delivers it through hands-on work and technical leadership. The role tackles the hardest application security problems across product, platform, and AI-powered features, including problems with no established playbook. It shapes Engineering, Product, and Platform roadmaps so secure patterns become the default, and establishes standards that help many teams build securely without relying on one person. The engineer leads multi-year AppSec strategy and cross-team initiatives, represents AppSec in cross-department decisions, and sets secure design, code review, and risk-model standards. The role also leads architecture reviews and threat modeling for complex systems, develops secure-by-default building blocks, shapes vulnerability management, and remains hands-on with code review, exploit development, bypass testing, variant analysis, and remediation. The position establishes AI-augmented AppSec practices and automation for code review, threat modeling, triage, and remediation. It also defines security approaches for Apollo’s AI systems and agent features, including input and output handling, exposed APIs, guardrails, tool permissions, and data-exfiltration paths. Success includes embedding AppSec work into other teams’ roadmaps, reducing high-risk vulnerability classes, and enabling AI-assisted workflows adopted beyond Security. Apollo’s technology stack includes React; Ruby, Ruby on Rails, Python, MongoDB, and Elasticsearch; Kubernetes, Docker, and Terraform; and GCP.

Requirements

Track record of leading AppSec strategy that changed how several engineering teams build, with measurable results; typically backed by 10+ years in software engineering or application security.
Expert code review, penetration testing, and exploit development skills, including the ability to find design flaws in unfamiliar codebases and land fixes that withstand bypass attempts.
Strong software development skills and the ability to ship production code.
Strong Linux and cloud fundamentals; GCP and Kubernetes are ideal.
Deep experience with secure architecture, authentication and authorization patterns, and building security building blocks adopted by other teams.
Hands-on experience securing AI-powered systems or agent features, and a clear point of view on how AI changes application security.
Sound judgment for making difficult risk decisions under ambiguity, and influence to align technical and non-technical leaders without formal authority.

Nice To Haves

Ruby and Ruby on Rails experience; Python is a plus.
Experience leading security for AI-native products, internal agents, or AI-assisted engineering workflows at scale.
Experience building or scaling a security champions or developer enablement program.
Public security work such as CVEs, research, talks, or open-source tools, or certifications such as OSCP or OSWE.

Responsibilities

Lead Apollo’s multi-year application security strategy and translate it into cross-team initiatives tied to Security department key results.
Report progress, risks, and tradeoffs to Security leadership on a regular cadence.
Shape Engineering, Product, Platform, and Data roadmaps so security work is planned early, and represent AppSec in cross-department decisions.
Set secure design, code review, and risk-model standards across the department and adjacent engineering teams, including expectations for AI-generated and agent-generated code.
Mentor senior engineers and security champions, grow the champions program, and help raise the hiring bar.
Lead security architecture reviews and threat modeling for ambiguous, high-scale, multi-team systems, including AI and agent features.
Design secure-by-default building blocks, such as shared authorization, safe OAuth and token handling, and SSRF-safe HTTP clients, and drive their adoption.
Shape vulnerability management across internal reviews, bug bounty, penetration tests, software composition analysis, and runtime findings, emphasizing root causes and risk-based severity decisions.
Review code across teams, develop exploits, test bypasses, and lead variant analysis and staged remediation for difficult cases.
Set standards for AI-augmented AppSec, using AI and agents for code review, threat modeling, triage, and remediation, and build automation adopted beyond Security.
Define how Apollo secures AI systems and agent features, including input and output handling, AI-exposed APIs, prompt and response guardrails, tool permissions, and data-exfiltration paths.