> Markdown version of [/jobs/ext/4661724-security-engineer](https://www.wearedevelopers.com/jobs/ext/4661724-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Engineer

- **Company:** HomeAdvisor Powered By Angi
- **Location:** United States (Remote available)
- **Experience:** Expert
- **Salary:** $150,000 - $225,000
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Amazon Web Services, Software System Penetration Testing, Burp Suite, Cloud Computing, Static Program Analysis, Cyber Security, Python (Programming Language), Network Security, OAuth, OpenID, Open Web Application Security, PCI Data Security Standards, Fortify (Software), Ruby, Next.js, Security Assertion Markup Language (SAML), Scala (Programming Language), Large Language Models, Sonatype, Software Security, Veracode, Cloudformation, Kotlin, Kubernetes, Virtual Agents, Terraform, Burpsuite, Qualys, Vulnerability Analysis
- **Published:** November 10, 2026
- **Apply:** https://startup.jobs/senior-security-engineer-application-security-angi-com-10721951

## About the Role

* 5+ years in security engineering, spanning at least two of: application security, cloud/infrastructure security, or enterprise security.
 * Hands-on with AWS and infrastructure-as-code (Terraform, CloudFormation, or equivalent); comfortable reading and contributing to product service code (Kotlin, NextJS, Python, Ruby, Scala, or Swift are preferred).
 * Sound build-versus-buy judgment with no allergy to either answer. You reach for what exists when it fits, and you're comfortable wrapping, extending, or replacing it when it doesn't.
 * Fluent in the OWASP Top 10 and how each is actually remediated, and in the authentication and authorization standards Angi runs on (OAuth, OIDC, SAML).
 * Some level of exposure to LLM/agentic system security (prompt injection, agent identity, data exfiltration via AI systems).
 * A daily, fluent user of AI-assisted coding/security tools. You are able to speak concretely about how you direct and verify AI output.
 * Strong written communication: you'll write threat models and give written feedback on other people's design docs and merge requests regularly.
 * Comfort executing the technical side of a compliance framework (PCI, SOX, or similar) - vulnerability scanning, control reviews, tamper detection is preferred.
 * Hands-on experience in the tool categories this work runs through - static analysis (Snyk, Veracode, Fortify), infrastructure vulnerability scanning (Qualys, Tenable, Rapid7), and penetration testing tooling (BurpSuite, OWASP ZAP) is preferred.
 * Container and Kubernetes experience is preferred.

## Description

* Own security initiatives end to end across cloud infrastructure hardening and application security, including work that spans several sprints and arrives ambiguous.
 * Own the technical controls that InfoSec retains within compliance frameworks such as PCI DSS (e.g., ASV scanning, network security control reviews, tamper-detection monitoring).
 * Deploy and tune the infrastructure protecting Angi's applications from exploitation, account takeover, and denial of service.
 * Drive security architecture and threat modeling for Angi's AI agent products (voice/chat agents with calendar and account access).
 * Review RFCs, PRDs, and MRs from a security lens, and partner directly with product/engineering teams shipping AI-native features. You will be in the room when these are designed, not brought in after the fact.
 * Build the tooling and frameworks that make the secure path the easy path for Angi's engineers - paved roads, not policy documents.
 * Mentor engineers within and across teams, and improve the status quo where you find it - recurring incident patterns, tooling gaps, process debt.
 * Actively participate in all facets of the incident response lifecycle by participating in a 24/7 on-call rotation.
 * Continuously evaluate and integrate AI-driven tooling into InfoSec's own workflows. You're expected to use AI coding/security assistants daily, not just secure them for others.