Senior Application Security Engineer (all genders)

About This Opportunity

We are representing a confidential travel technology client who is building their first dedicated Application Security function. This is a genuine greenfield opportunity where you will establish security practices from the ground up for a platform serving millions of users across 70+ countries. You will work with public APIs, payment systems, and active bug bounty programs, defining security standards for approximately 150 engineers and seeing measurable impact within weeks.

Responsibilities

• Lead threat modeling and secure design reviews for high-risk changes, partner integrations, and payment processing flows
• Implement, tune, and enforce security gates in CI/CD pipelines (SAST, SCA, secrets scanning, and DAST) while maintaining developer velocity
• Serve as primary technical owner for triaging, reproducing, and prioritizing findings from bug bounties, partner penetration tests, and automated scanners
• Collaborate hands-on with DevOps teams to implement cloud organizational policies, IAM least-privilege architectures, and WAF/rate limiting solutions
• Establish a security champions network across engineering squads and leverage automation and AI-assisted tooling to scale code review processes
• Build the "paved road" for secure development practices across the entire engineering organization

What We're Looking For

• 5+ years in Application Security, or 3+ years with strong software engineering or web penetration testing background, demonstrating true ownership of security outcomes
• Ability to read and write production code in languages such as Python, Go, TypeScript, or Ruby, with deep understanding of web frameworks, CI/CD systems, and Kubernetes
• Deep expertise in web and API security, including authentication/authorization models (OAuth2, JWT), rate limiting, tenant isolation, IDOR, and XSS vulnerabilities
• Strong cloud security fundamentals (GCP preferred), particularly regarding public exposure management, secrets hygiene, and WAF rule configuration
• Risk-based prioritization skills with ability to propose practical trade-offs and communicate complex security risks clearly to both engineers and leadership
• Bonus: Experience securing high-volume, multi-tenant B2B APIs and utilizing AI tooling to accelerate security triage and review processes

How We Work With You

Candidates apply directly through Get A Job.ai. Our recruitment team will conduct an initial screening to understand your experience and career goals. Qualified candidates are then submitted to our client for their interview process. Please do not contact the client directly—all communication should flow through Get A Job.ai to ensure proper representation.

Pay

Compensation details will be discussed during the screening process based on experience and location.

Equal Opportunity

Get A Job.ai is committed to inclusive recruiting practices and works with clients who value diverse perspectives and backgrounds.