W2 - 10+ Application Security Engineer - (Bay Area/NYC/REMOTE)

1. Vulnerability Reproduction & PoC Validation * Construct minimal local test environments, dependency mocks, and reproduction harnesses to validate reported security findings. * Distinguish true, exploitable vulnerabilities from scanner false positives and attach clear, reproducible evidence to issue tickets.

2. Automated / Agentic Patch Oversight & QA * Supervise, review, and validate code patches generated by automated and AI/agentic remediation systems before they are routed to product code owners. * Inspect code diffs for logic flaws, hallucinations, off-by-one errors, memory safety issues, and unintended functional regressions. * Execute unit, integration, and differential tests to confirm both fix efficacy and build stability (targeting a 90% patch acceptance rate by code owners without major revision).

3. Vulnerability Triage & Policy Evaluation * Review, filter, and prioritize incoming findings from automated static (SAST) and dynamic/endpoint scanning tools within a 24-48 hour turnaround window. * Classify vulnerability severity using standardized scoring rubrics and map valid findings to strict remediation SLAs. * Evaluate standard compliance exception requests against established security policies and escalate ambiguous, disputed, or architectural edge cases to senior security leads.

4. Threat Modeling & Asset Profiling * Document architectural entry points, trust boundaries, attack surfaces, and data flows for high-priority services. * Maintain standardized threat models and service risk classification tags in centralized repositories.

5. Engineering Coordination & Remediation Closure * Route verified, test-passing security patches (changelists / pull requests) to designated product engineering owners. * Shepherd fixes through code review, track remediation SLAs, and verify end-to-end deployment to production.

We are seeking a seasoned Application Security & Vulnerability Validation Engineer (5+ years of experience) to serve as the operational and technical bridge between automated/AI-driven security scanning and remediation systems and product engineering teams., * Experience: 5+ years of hands-on experience in Application Security, Product Security, or Software Engineering with a strong focus on vulnerability validation, secure code review, and test automation.

• Programming & Test Harness Development: Proficiency in reading, writing, and debugging code in at least two core languages (C++, Go, Java, or Python), with the ability to set up local test harnesses, mock dependencies, and build minimal PoCs.
• Secure Code Review: Deep understanding of secure coding standards (input validation, boundary checking, safe memory access, concurrency safety) and high attention to detail when reviewing code diffs for regressions, hallucinations, or off-by-one errors.
• Vulnerability & Policy Fundamentals: Working knowledge of common vulnerability classifications (CWE, CVE, OWASP Top 10), vulnerability scoring matrices, and SLA-driven remediation workflows.
• Threat Modeling: Understanding of architectural trust boundaries, data flows, attack surfaces, and structured threat modeling frameworks (e.g., STRIDE, PASTA).
• Engineering Communication: Clear written and verbal communication skills to document reproduction steps, justify severity classifications, and collaborate constructively with software engineering owners through code review.

Preferred Qualifications (Nice-to-Haves)

• AI / Automated Remediation QA: Experience validating, debugging, or prompt-tuning automated code generation tools, along with automated patch validation and differential testing.
• Advanced Dynamic Testing: Practical experience with fuzz testing, unit/integration test frameworks, sandbox execution environments, and debugging complex runtime or logic errors across service