Staff II - Application Security Engineer

Omnissa is the first AI-driven digital work platform, built to support flexible, secure, work-from-anywhere experiences. The Staff II Application Security Engineer will lead the technical direction for application security, influencing architecture and engineering decisions across teams while tackling complex security challenges.

Responsibilities:

• Set technical direction for application security across the portfolio — defining standards, patterns, and guardrails adopted by engineering teams at scale
• Lead threat modeling across distributed, cloud-native, and mobile architectures as a repeatable practice embedded in the development lifecycle, not a one-off exercise
• Define security architecture reference designs that, when followed by engineering teams, remove the need to security-review that aspect on a per-feature basis
• Identify architectural risk early and influence roadmap and design decisions before implementation begins
• Perform manual code review and application security testing across Java and C++ codebases; codify findings into reusable guidance engineers can act on without follow-up
• Scale code review coverage using AI-assisted analysis and custom CodeQL queries tuned to Omnissa's codebase and vulnerability patterns
• Conduct variant analysis to ensure confirmed vulnerability classes are remediated consistently across the codebase, not in isolation
• Triage and validate externally reported vulnerabilities — assess exploitability, severity, and business impact, and drive remediation to closure across team boundaries
• Translate individual findings into systemic recommendations that address root-cause design or implementation gaps across products
• Define and evolve the SDL — identify gaps, drive measurable improvements, and own the iteration cycle
• Improve the feature security review program so security work shifts left into design and scales across teams, rather than landing as a release gate
• Mature the product penetration testing program — define scope, methodology, and cadence; ensure findings drive systemic fixes, not one-off patches
• Build and scale the security champions program; mentor engineers and create training that extends security capability beyond the security team
• Establish metrics that make program effectiveness visible to engineering and product leadership
• Build a deep understanding of the product architecture, development toolchain, and release process across multiple product areas
• Own the security strategy for a significant area of the portfolio. Set direction that other engineers execute against, drive cross-team prioritization of security work, and shape backlog and roadmap decisions
• Deliver measurable, org-level improvements in security posture — e.g., materially reduced mean time to remediation, broadened threat model coverage, or new automation adopted in production across teams
• Identify and drive improvements to security processes - both internal workflows and partner-facing interfaces - that reduce friction for development teams and increase the daily effectiveness of security engineers

Requirements:

• 12+ years of hands-on application security experience, with demonstrated technical depth and a track record of influence beyond your own work
• Deep knowledge of application security vulnerabilities and mitigation techniques, and the judgment to prioritize them by real business and customer impact
• Proven ability to lead threat modeling, secure design, and security architecture for complex distributed and cloud-native systems
• Proficiency in Java or C++, with the ability to read, reason about, and review production code
• Security breadth across multiple domains — application, system, cloud, and mobile
• A demonstrated history of driving technical change and raising the security bar across teams, and of mentoring senior engineers
• Excellent documentation and communication skills, including the ability to influence engineering and product leadership
• Self-starter who is adaptable, works independently, and brings clarity to ambiguous problems
• A pragmatic mindset; able to identify practical short term and long term strategic solutions
• Experience testing agentic AI systems, and the ability to leverage AI tooling across security testing, triage, and documentation workflows
• Experience building automation solutions that improve the security process at scale
• Prior experience as a pen tester for a multi-tenant SaaS provider