> Markdown version of [/jobs/ext/543733-senior-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/543733-senior-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Application Security Engineer

- **Company:** Barracuda Networks, Inc.
- **Location:** United States (Remote available)
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Java (Programming Language), JavaScript (Programming Language), Software System Penetration Testing, Code Review, Continuous Integration, Python (Programming Language), Ruby, Web Application Security, Session Management, TypeScript, Software Vulnerability Management, Data Logging, Large Language Models, Software Security, Static Application Security Testing, Golang, Programming Languages
- **Published:** June 13, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=5ef2de8df3a68e9b

## About the Role

Do you have experience in Web Application Security Testing?, * 5 - 8+ years in product-focused AppSec, with a track record of embedding security and reducing late-stage findings via automation and developer enablement

 * Deep practical knowledge of core security concepts (authN/Z, session management, input/output handling, logging, data protection, access controls)
 * Proficient in at least two programming languages (TypeScript/JavaScript, Python, Ruby, Java, Go, etc.)
 * Hands-on experience with application penetration testing and code reviews
 * Proficient in threat modeling and risk-based analysis
 * Strong organizational, time-management, communication, and presentation skills

## Description

As a Senior Application Security Engineer, you'll help shape the future of our AppSec program. You'll work effectively and efficiently in a small, high-impact team, bringing a sense of ownership and community. You'll have the opportunity to learn quickly, provide feedback on long-term improvements, and drive strategic security initiatives across our product portfolio.
Tech Stack:

 * TypeScript/JavaScript, Python, Ruby, Java, Go
 * CI/CD automation tools (SAST, SCA, Secrets Scanning, etc.)
 * AI security controls and LLM risk management

What you'll be working on

 * Embed security across the development lifecycle, moving from pen-test/documentation-heavy to guardrail-driven programs
 * Facilitate lightweight, feature-level threat models and drive risk-based discussions
 * Perform hands-on application penetration tests and security-focused source code reviews
 * Drive risk rating and vulnerability management processes
 * Partner with product, platform, and engineering leads to drive security initiatives
 * Lead outcome-focused design review discussions and security trainings
 * Provide framework-specific remediation guidance to developers


## Related Videos

- [Coffee with Developers: David Heinemeier Hansson](https://www.wearedevelopers.com/videos/875-coffee-with-developers-david-heinemeier-hansson)
- [Go with the Flow: Stop the Leaks Before Your Memory's a Waterfall!](https://www.wearedevelopers.com/videos/100073-go-with-the-flow-stop-the-leaks-before-your-memory-s-a-waterfall)
- [Do TypeScript without TypeScript](https://www.wearedevelopers.com/videos/327-do-typescript-without-typescript)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [Coroutine explained yet again 60 years later](https://www.wearedevelopers.com/videos/690-coroutine-explained-yet-again-60-years-later)
- [Software Security 101: Secure Coding Basics](https://www.wearedevelopers.com/videos/220-software-security-101-secure-coding-basics)

## Related Articles

- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [93 Java Interview Questions You Should Prepare For](https://www.wearedevelopers.com/magazine/14-93-java-interview-questions-you-should-prepare-for)
- [The 8 Best Code Testing Tools](https://www.wearedevelopers.com/magazine/402-the-8-best-code-testing-tools)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)