Staff Security Engineer, AppSec

How You Will Make a Difference Day to Day:

• Threat Modeling: Lead the development of comprehensive threat models for new and existing products to identify, assess, and mitigate security risks.
• Vulnerability Management: Establish and manage a vulnerability management lifecycle for our applications, ensuring timely detection, reporting, and remediation of security vulnerabilities.
• Security Programs: Design and implement application security programs focused on building security into the software development lifecycle (SDLC) and establishing secure coding practices.
• Collaboration with Engineering: Partner with product and engineering teams to integrate security requirements into architectural designs and development processes.
• Security Audits & Assessments: Conduct regular security assessments of applications and infrastructure, focusing on identifying areas of weakness and recommending actionable improvements.
• Security Incident Response: Support the incident response team in application-related security incidents by providing expertise on containment, eradication, and post-incident analysis.
• Security Awareness: Mentor and coach engineering teams on security best practices and create security awareness initiatives tailored to the development environment.
• Automation & Tooling: Drive the adoption of security automation, including code scanning, security testing, and CI/CD pipeline integration to streamline security processes.

Minimum Qualifications:

• Bachelor's or Master's degree in Computer Science, Cybersecurity, or a related field, or equivalent experience.
• 8+ years of experience in application security, preferably within a SaaS environment.
• Strong proficiency in threat modeling, secure coding practices, vulnerability management, and incident response.
• Hands-on experience with security tools such as static/dynamic analysis tools (SAST, DAST), penetration testing tools, and CI/CD pipeline integration.
• Familiarity with modern programming languages (e.g., Python, JavaScript, Go) and cloud platforms (e.g., AWS, GCP, Azure).
• Industry certifications such as CISSP, OSCP, or CEH are a plus.
• Required to work on-site 5x a week in our Miami office (Coral Gables).

Minimum Qualifications:

• Technical Leadership: Demonstrated ability to lead and guide teams in the development and execution of security initiatives.
• Threat Analysis: Strong understanding of threat modeling techniques, application security risks (OWASP Top Ten), and secure coding practices.
• Risk Management: Expertise in managing security vulnerabilities and threats through identification, prioritization, and mitigation strategies.
• Communication: Excellent communication skills to effectively collaborate with cross-functional teams, present complex security concepts, and advocate for secure design practices.
• Innovation & Problem Solving: Creative thinker with the ability to develop novel security solutions in response to emerging threats and vulnerabilities.
• Continuous Improvement: Strong commitment to staying up-to-date with evolving security standards and best practices, and a passion for continuous learning and improvement.