Application Security Engineer

Responsibilities

• product and engineering lifecycle early, shaping secure design decisions before code is written, and
• validating them through rigorous assessment.
• ● Own application security responsibility for assigned business functions by performing threat
• modeling, architecture reviews, penetration testing, secure coding programs, and vulnerability
• management.
• ● Perform manual penetration testing and vulnerability assessments on web applications, APIs,
• and android mobile applications.
• ● Own security incident response for product-layer issues, define remediation plans, and track
• fixes through to closure.
• ● Integrate and tune SAST/DAST/IAST/SCA tools in CI/CD, create custom rules where needed and
• actively triage false positives.
• ● Review and harden cloud infrastructure — Kubernetes RBAC, pod security, network policies,
• Firebase.
• in language that drives actionable results.
• ● Experience in manually testing web apps, APIs, and Android apps, manual code reviews

About the role

We are looking for an Application Security Engineer to own the end-to-end security posture of our product platform — spanning mobile applications, REST APIs, microservices, cloud infrastructure, and third-party integrations. In this role, the Application Security Engineer will be involved into the

What you will be expected to do

• ● Perform security reviews for AI‐native products, models, pipelines, and inference services.
• ● Onboard applications into the SSDLC program and be a security point of contact for the application product.
• Istio service mesh, Keycloak/OIDC configurations, and IAM across AWS, DigitalOcean, GCP, and
• ● Communicate vulnerabilities and risk clearly to developers, product managers, and leadership
• ● Conduct application security training for engineers, product managers etc.
• You might be a strong candidate if you have/are
• ●Bachelor's degree in Computer Science, Cyber Security, or any related fields.
• ● At least 2 years of hands-on application security experience, ideally in product‐based or SaaS companies working directly with engineering teams.
• ● Good understanding of OWASP Top 10, API Security Top 10, and common authorization flaws including BOLA, BFLA, and privilege escalation.
• (beyond just running tools).
• ● Familiarity with OAuth2, OIDC, JWT, and typical misconfigurations in providers such as Keycloak and Firebase.
• ● Experience integrating and tuning SAST/DAST (and optionally SCA/IAST) tools within CI/CD pipelines.
• ● Exposure to cloud‐native security: Kubernetes, containers, service mesh (Istio mTLS and policies), and IAM concepts across at least one major cloud provider.
• ● Experience with Cloudflare WAF, perimeter security scanning, and/or red‐team testing is a plus.
• ● Familiarity with AI/LLM security risks (e.g., OWASP LLM Top 10).
• ● Practical experience implementing guardrails, prompt validation, output filtering, or other safety controls in production AI features, or assessing insecure use of third‐party AI APIs.
• ● Ability to script/automate (e.g., Python, Bash) to streamline testing, data collection, and reporting.
• ● Interest in or experience with building AI based security tools that improve coverage or reduce manual toil.

What Sun King offers

• Professional growth in a dynamic, rapidly expanding, high-social-impact industry
• An open-minded, collaborative culture made up of enthusiastic colleagues who are driven by the challenge of innovation towards profound impact on people and the planet.
• A truly multicultural experience: you will have the chance to work with and learn from people from different geographies, nationalities, and backgrounds.
• Structured, tailored learning and development programs that help you become a better leader, manager, and professional through the Sun King Center for Leadership.