Sr. Application Security Engineer

Mitek Systems is a global leader in digital and biometric identity authentication, fraud prevention, and mobile deposit solutions. The Senior Application Security Engineer serves as a hands-on technical authority responsible for securing software products, partnering with Engineering to identify and remediate vulnerabilities, and maturing the Secure SDLC, application security tooling, and preventative controls.

Responsibilities:

• Perform hands-on security analysis of applications, services, APIs, and supporting components
• Work directly in Java, Python, and Go codebases to identify security weaknesses, understand root cause, and recommend practical remediation
• Conduct manual secure code reviews of security-sensitive components and application changes
• Partner directly with software engineers to troubleshoot vulnerabilities and develop secure solutions
• Develop reusable secure coding patterns, controls, and automation that prevent recurring vulnerability classes
• Own application vulnerability remediation from initial finding through validation, prioritization, remediation, retesting, and closure
• Personally reproduce and validate vulnerabilities rather than relying solely on scanner severity or external reports
• Assess actual application risk using factors such as exploitability, code reachability, application exposure, data sensitivity, business criticality, and compensating controls
• Work with development teams to explain findings, identify root cause, and determine the appropriate remediation
• Drive systemic fixes rather than repeatedly addressing individual instances of the same vulnerability
• Maintain clear remediation SLAs and escalate unresolved Critical and High findings when appropriate
• Help define and mature security gates and review checkpoints throughout the SDLC
• Embed security requirements into architecture, design, sprint, and release processes
• Integrate preventative security controls into developer workflows and CI/CD pipelines
• Partner with Engineering to make secure development practices practical and scalable
• Operate, configure, and tune SAST, DAST, and SCA tooling to produce actionable developer findings
• Investigate scanner output and distinguish meaningful security risk from false positives and low-risk findings
• Evaluate software dependency vulnerabilities using application context, including reachability, vulnerable-function usage, exploitability, and remediation options
• Partner with developers on dependency upgrades, replacement strategies, exceptions, and compensating controls
• Improve security automation and feedback within CI/CD workflows
• Threat-model new features and significant architectural changes before code is written
• Review designs for authentication, authorization, trust boundaries, data flows, cryptographic controls, and abuse scenarios
• Use methodologies such as STRIDE, PASTA, or equivalent approaches
• Translate threat-model findings into practical engineering requirements and security controls
• Review application and API security controls including authentication, authorization, OAuth 2.0/OIDC, mTLS, rate limiting, and abuse prevention
• Partner with teams building cloud-native applications in AWS, Kubernetes/EKS, containers, and Linux/Ubuntu environments
• Evaluate application security risks across distributed services and cloud-native architectures
• Build strong working relationships with Engineering and operate as a technical partner rather than a security gatekeeper
• Provide developers with clear, actionable remediation guidance
• Deliver secure-coding guidance and training based on real vulnerabilities and recurring patterns
• Help develop and mature a Security Champions program across development teams
• Create runbooks, standards, and secure-development patterns teams can use independently
• Validate application and API vulnerabilities through hands-on testing when needed
• Coordinate external penetration-testing engagements, validate reported findings, and drive remediation

Requirements:

• 7+ years of progressive experience in Application Security, Product Security, security-focused software engineering, or a closely related discipline
• Demonstrated senior-level ownership of Application Security initiatives and vulnerability remediation
• Strong hands-on coding and secure code review experience in Java, Python, and Go
• Ability to read, debug, and reason about production application code and communicate effectively with software engineers
• Ability to independently reproduce vulnerabilities, trace findings to root cause, assess exploitability and reachability, and validate remediation
• Hands-on experience with SAST, DAST, and SCA tooling and integrating security testing into engineering workflows
• Strong knowledge of software dependency and supply-chain security
• Experience prioritizing vulnerabilities using application and business context rather than scanner severity alone
• Strong understanding of OWASP Top 10 and OWASP API Security risks
• Experience with threat modeling using STRIDE, PASTA, or similar methodologies
• Experience securing cloud-native applications running in AWS and Kubernetes/EKS environments
• Strong communication skills and the ability to influence developers, architects, and engineering leadership
• Hands-on application and API penetration-testing experience
• Financial services, fintech, identity, fraud, or regulated SaaS experience
• Experience with PCI-DSS application security requirements
• Experience building or leading a Security Champions program
• Experience developing AppSec automation or internal security tooling
• OSCP, GWEB, CSSLP, or similar technical security certification