Application Security Engineer

Own and improve application security across applications, APIs, cloud services, and CI/CD pipelines. Manage penetration testing programs, vulnerability remediation, security scanning, WAF and API protections, threat modeling, secure design reviews, and security automation. Partner with development, cloud, compliance, and security teams to remediate critical findings, support audits, improve secure coding, and provide security guidance. The role also involves leveraging AI-enabled tools for vulnerability triage and remediation., The Senior Application Security Engineer is a hands-on role within Production Engineering, responsible for improving the security of Accelerant’s applications, APIs, cloud services, and software delivery practices.

The role combines application security engineering, vulnerability management, penetration testing, security automation, application perimeter protection, and close partnership with development squads.

A key responsibility will be turning security findings into completed remediation. The successful candidate will work directly with development squads to prioritize and close Critical and High vulnerabilities, using proactive processes and security AI agents to improve triage, exploitability analysis, remediation guidance, and verification. Role Expectations

• Own and improve application security practices across web applications, APIs, services, and CI/CD pipelines.

• Manage the external penetration testing program, including planning, scoping, scheduling, vendor engagement, communications, findings review, remediation tracking, and retesting.

• Broker the relationship between development teams and third-party penetration testing providers to ensure clear expectations, effective testing, and timely closure of findings.

• Work directly with development squads to prioritize and close Critical and High CVEs and other significant application security findings.

• Build proactive vulnerability remediation processes using approved security AI agents and automation.

• Operate and improve SAST, DAST, SCA, container, secrets, and vulnerability-scanning capabilities within development workflows.

• Maintain and continuously improve WAF policies, application perimeter protections, API security policies, filtering, and rate-limiting controls.

• Support threat modeling, secure design reviews, vulnerability assessments, incident response, and secure coding practices.

• Work with Compliance to gather and maintain evidence supporting ISO 27001, SOX, and SOC 1/2 requirements.

• Partner with Development, Architecture, Cloud/DevOps, Compliance, and other Security disciplines to embed security into delivery practices.

• Provide clear security guidance, documentation, reporting, and education to technical teams. Technical Skills and Related Experience Required, Own and improve application security across applications, APIs, cloud services, and CI/CD pipelines. Manage penetration testing programs, vulnerability remediation, security scanning, WAF and API protections, threat modeling, secure design reviews, incident response, and compliance evidence. Partner with developers, vendors, cloud teams, and compliance stakeholders to close critical findings and embed secure delivery practices through automation and security AI tooling. Top Skills: AWSCi/CdCloudflare EdgeCloudflare Zero TrustDastDependabotEksGithub Advanced SecurityKubernetesOwasp Top 10PythonQualysSastScaSnykTrivyWaf Forward Financing

• 5+ years of experience in application security, product security, DevSecOps, or a related discipline.

• Strong understanding of web application and API security, authentication, authorization, sessions, common attack patterns, and the OWASP Top 10.

• Experience managing external penetration testing or similar third-party security assessment programs.

• Experience with vulnerability management and security-scanning tools such as Snyk, Qualys, Trivy, Dependabot, GitHub Advanced Security, or equivalent platforms.

• Experience integrating security controls into CI/CD pipelines and development workflows.

• Experience with WAF policy management, API security, virtual patching, filtering, rate limiting, and application perimeter protection.

• Practical experience with cloud security, preferably AWS and Kubernetes/EKS.

• Experience with security automation, scripting, or programming, preferably Python.

• Strong communication and relationship-management skills, with the ability to work effectively with developers, vendors, and control owners. Nice to Have Skills

• Experience using AI-enabled security tooling or automation to support vulnerability triage and remediation.

• Cloudflare Zero Trust and Cloudflare Edge experience.

• OSCP, OSCP+, or an equivalent security certification.

• OSCP, OSCP+, or an equivalent security certification is preferred.

One Month Ago Remote 145K-183K Annually Senior level 145K-183K Annually Senior level Fintech * Financial Services Conduct manual penetration testing, secure code reviews, and SAST triage across web applications, APIs, and AWS infrastructure. Develop AI-assisted security tooling, define testing approaches for LLM applications and agentic systems, and review AI-generated software before production. Communicate vulnerabilities, risks, and remediation priorities to engineering teams while improving secure SDLC practices. Top Skills: Ai AgentsAWSGoLlmsPythonRubySastTypescript Grow Therapy, 182K-288K Annually Senior level 182K-288K Annually Senior level Healthtech * Social Impact * Software Build and advance application and product security across the engineering organization. Responsibilities include establishing secure defaults, CI guardrails, security requirements, threat modeling, risk assessments, penetration testing, vulnerability remediation, secure coding education, roadmap ownership, and hands-on code review. The role partners closely with product, engineering, DevOps, and services teams to secure applications, microservices, and AI features while enabling efficient development. Top Skills: Ci/CdDastMicroservicesPenetration TestingSastSbomThreat Modeling

What you need to know about the Colorado Tech Scene

With a business-friendly climate and research universities like CU Boulder and Colorado State, Colorado has made a name for itself as a startup ecosystem. The state boasts a skilled workforce and high quality of life thanks to its affordable housing, vibrant cultural scene and unparalleled opportunities for outdoor recreation. Colorado is also home to the National Renewable Energy Laboratory, helping cement its status as a hub for renewable energy innovation.

Key Facts About Colorado Tech

• Number of Tech Workers: 260,000; 8.5% of overall workforce (2024 CompTIA survey)
• Major Tech Employers: Lockheed Martin, Century Link, Comcast, BAE Systems, Level 3
• Key Industries: Software, artificial intelligence, aerospace, e-commerce, fintech, healthtech
• Funding Landscape: $4.9 billion in VC funding in 2024 (Pitchbook)
• Notable Investors: Access Venture Partners, Ridgeline Ventures, Techstars, Blackhorn Ventures
• Research Centers and Universities: Colorado School of Mines, University of Colorado Boulder, University of Denver, Colorado State University, Mesa Laboratory, Space Science Institute, National Center for Atmospheric Research, National Renewable Energy Laboratory, Gottlieb Institute

Accelerant is a data-driven risk exchange connecting underwriters of specialty insurance risk with risk capital providers. Accelerant was founded in 2018 by a group of longtime insurance industry executives and technology experts who shared a vision of rebuilding the way risk is exchanged - so that it works better, for everyone. The Accelerant risk exchange does business across more than 20 different countries and 250 specialty products, and we are proud that our insurers have been awarded an AM Best A- (Excellent) rating. For more information, please visit www.accelerant.ai.