Senior Application Security Engineer

Join Sardine, a fintech company that makes risk and payment decisions for banks and fintechs. As a Senior Application Security Engineer, you will be responsible for identifying and mitigating security vulnerabilities in our applications and APIs. You will work closely with engineers to implement secure coding practices and drive remediation efforts. This is a remote-first position with a range of benefits, including unlimited paid time off, generous equity compensation, and comprehensive health insurance coverage.

Responsibilities

• Automating the vulnerability pipeline, including triaging, validating, routing, and driving remediation of findings from various sources.
• Building the automation that removes manual effort from each step of the vulnerability management process.
• Spotting patterns across findings and removing the root cause, not just the instance, by setting secure patterns and defaults.
• You disagree in the open, with evidence, and update when someone brings better evidence
• Your influence travels asynchronously, across time zones, to people with strong opinions and no reporting line to you

You separate real findings from theoretical ones

• Vulnerability management, automated. Experience running vulnerability management end to end, and automating it with code against scanner, ticketing, and source-control APIs
• Scaling security tooling across many repositories, languages, and build systems

Requirements

• Code auditing in at least one of Go, Python, Node.js, Ruby, or Java, and the willingness to work in the rest
• SAST, DAST, and SCA in CI/CD, tuned so engineers trust the output. Cloud fundamentals on GCP or AWS. Docker and Kubernetes
• Practical command of the OWASP Top 10, with real depth in broken access control and business logic flaws
• An engineering background. You have shipped and maintained real software. You read unfamiliar code quickly, review it rigorously, and reason about architecture and failure modes
• Judgment over tenure. We care more about the depth of your judgment than your years of experience
• Ownership to done. You take problems all the way through, including fixes that depend on other teams. You follow up on the fix you recommended three sprints ago
• Fintech, payments, or other environments under serious third-party security review (PCI DSS, SOC 2, customer audits)
• Fully distributed, asynchronous engineering experience
• Advanced offensive certifications. OSWE and BSCP are the most relevant; CPTS, CRTO, and similar also count

Preferred

• Prior experience writing custom static analysis rules (Semgrep, CodeQL, or similar)
• Offensive experience in whatever form you found it. Pentesting on web, API, mobile, or cloud is the most directly relevant. Hardware and embedded work, physical security and lock sport, red team engagements, protocol and radio work, and CTF or bug bounty results all count
• Public work: research, tooling, disclosures, talks

Pay

USD 135,000 - 180,000