> Markdown version of [/jobs/ext/212188-security-engineer-vuln-management-code](https://www.wearedevelopers.com/jobs/ext/212188-security-engineer-vuln-management-code). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Engineer - Vuln Management (Code) - **Company:** Replit, Inc. - **Location:** Foster City, CA, United States - **Experience:** Experienced - **Salary:** $210,000.0 - $270,000.0 - **Contract:** Permanent contract - **Skills:** JavaScript (Programming Language), Automation of Tests, Python (Programming Language), Package Management Systems, PCI Data Security Standards, Web Application Security, Software Engineering, Software Systems, TypeScript, Software Vulnerability Management, Software Security, Tenable Nessus, Build Tools, Checkmarx, Devsecops, Static Application Security Testing, Vulnerability Analysis, Golang - **Published:** May 21, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=07cdf34c28f7ea26 ## About the Role Do you have experience in Web Application Security Testing?, * Experience: 5 years of experience in Application Security, DevSecOps, or Software Engineering roles. * Development Background: Solid foundational experience working in a software development capacity. * Code Literacy: Ability to read, understand, and safely patch security flaws in JavaScript/TypeScript, Python, and Go. * Build System Expertise: Strong familiarity with build systems, package managers, and compilation workflows across multiple languages and frameworks. * AppSec Tooling Expertise: Hands-on experience operating SAST, SCA, and Secret Scanning tools (such as Snyk, Socket, Wiz Code, Semgrep, or Checkmarx). * Compliance Awareness: Understanding of how vulnerability management maps to security compliance frameworks like SOC 2, ISO 27001, or NIST., * Systems Thinking: The ability to see the "big picture" and understand how security decisions impact the entire stack. * Technical Influence: The ability to drive technical alignment across the organization through expertise and collaboration rather than direct authority. * Autonomy: Comfortable leading major technical initiatives and driving outcomes with minimal oversight. * Problem-Solving Mindset: A passion for breaking down complex security challenges into elegant, scalable engineering solutions. ## Description We are seeking a mid-level AppSec Vulnerability Management Engineer with a strong software development background. In this role, you will bridge the gap between security, compliance, and engineering teams. You will identify application vulnerabilities, maintain software supply chain security, and drive tracking to satisfy strict regulatory compliance frameworks. You will also serve as a technical responder during security incidents, deploying real-time countermeasures to protect our software ecosystem., * Vulnerability Scanning & Triage: Perform periodic application security scanning activities. Review results and prioritize flaws based on CVSS scores, real-world exploitability, and system exposure. * Compliance-Driven Tracking: Track, document, and manage vulnerabilities according to strict compliance SLAs (e.g., SOC 2, ISO 27001, PCI-DSS). Maintain audit-ready evidence of remediation timelines and exception approvals. * Executive Reporting & Alerting: Escalate and report critical exposures directly to the CISO and senior leadership. Maintain dashboards and alerting mechanisms that visualize vulnerability status, risk trends, and compliance posture. * Software Supply Chain Security: Ownership of the organization's Software Bill of Materials (SBOM). Continually update SBOM inventories to ensure compliance with modern regulatory requirements and dependency tracking. Help Replit mature through various SLSA levels for supply chain security. * Remediation Collaboration: Partner with development teams to provide clear mitigation paths. Review, write, and patch code directly when necessary to resolve security flaws. * Tooling Integration: Configure and tune automated security testing tools within CI/CD pipelines to reduce false positives for engineering teams. * Incident Response Support: Assist Incident Response teams during active breaches or security incidents. Help develop and implement immediate, real-time code or infrastructure countermeasures. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [DevSecOps: Injecting Security into Mobile CI/CD Pipelines](https://www.wearedevelopers.com/videos/273-devsecops-injecting-security-into-mobile-ci-cd-pipelines) - [Go with the Flow: Stop the Leaks Before Your Memory's a Waterfall!](https://www.wearedevelopers.com/videos/100073-go-with-the-flow-stop-the-leaks-before-your-memory-s-a-waterfall) - [DevSecOps culture](https://www.wearedevelopers.com/videos/783-devsecops-culture) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [DevSecOps: Security in DevOps](https://www.wearedevelopers.com/videos/36-devsecops-security-in-devops) ## Related Articles - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)