> Markdown version of [/jobs/ext/4625563-senior-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/4625563-senior-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Application Security Engineer

- **Company:** Science Suite Corp.
- **Location:** San Francisco, CA, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Amazon Web Services, Code Review, Continuous Integration, Software Design Documents, Software Design Patterns, Python (Programming Language), Node.Js, Public Key Infrastructure, Systems Development Life Cycle, Cloud Services, Web Application Security, Software Engineering, Transport Layer Security, ReactJS, Large Language Models, Software Security, AI Coding Agents, Agentic-AI, Production Code, Cloudflare, Terraform, Static Application Security Testing, Dynamic Application Security Testing
- **Published:** November 7, 2026
- **Apply:** https://www.juju.com/job/28_25303_b0c80ea75f0c7c2da3a7e0f0389d50c8

## About the Role

* Demonstrable software engineering ability - you read code fluently, write production-quality code that engineers respect, and have contributed to real codebases (Node.js/React; Python a plus).
 * Fluency using AI development tools (AI coding assistants, agentic workflows) to get the job done, and a clear-eyed view of the security risks they introduce.
 * Expertise in web application security and secure-coding best practices, and the ability to review code and application findings.
 * Experience integrating and maintaining SAST/DAST systems within CI/CD, and with Secure Software Development Life Cycles.
 * Hands-on experience securing cloud workloads on AWS and comfort with infrastructure-as-code (Terraform or equivalent); familiarity with Cloudflare a plus.
 * Threat-modeling experience and command of common code and network vulnerability types, their impact, and remediation.
 * Applied knowledge of cryptography, PKI, and TLS and their practical implementation., * Experience hardening LLM-integrated or AI-powered features in production.
 * Experience operating a bug bounty program (e.g. HackerOne).
 * Contributions to SOC 2 control design and audit readiness from the engineering side.
 * Relevant certifications (e.g. OSCP, OSWE, AWS Security Specialty) - valued, but not a substitute for engineering ability.

## Description

* Contribute production-quality code directly to the application (Node.js/React) and infrastructure (Python, Terraform) - you ship fixes and hardening yourself, not just findings for others to action.
 * Build and maintain security and CI/CD tooling for automation, keeping the secure path the default path.
 * Act as a security reviewer on RFCs and design documents, and pair with engineers to resolve issues at the source.

Architecture, design & secure SSDLC

 * Define secure-by-design patterns and drive standards for authentication, authorization, and API security.
 * Lead threat modeling on new and existing systems and turn those models into shipped controls.
 * Own and evolve the Secure SDLC and CI/CD security integration (SAST/DAST/SCA/secrets) - tuned for high signal and low noise.