Senior Application Security Engineer

Sardine is hiring a Senior Application Security Engineer to strengthen application security for its risk and payments platform. The role focuses on automating vulnerability management, finding and eliminating recurring security flaws, and partnering with engineering teams on secure designs and fixes.

Responsibilities:

• Triage, validate, route, and drive remediation of findings from every source: SAST, DAST, SCA, code review, pentests, and bug bounty
• Build the automation that removes manual effort from each of those steps
• External pentests and bug bounty program: set scope, direct the testers, judge severity, and close the loop
• Spot the patterns across findings and remove the root cause, not just the instance
• Set the secure patterns and defaults that make the right way the easy way
• Write custom static analysis rules for our own anti-patterns, so a fixed bug class stays fixed
• Review platform-layer controls (authorization, service identity, secrets handling, gateway enforcement), find the gaps, and push the owning teams until they are closed
• Work alongside engineers on fixes that are simple, get adopted, and hold
• Hands-on testing of our applications and APIs, and manual code review of high-exposure services, with depth in authorization and business logic
• Threat modeling on new and high-exposure designs
• Security enablement across engineering, including a security champions program

Requirements:

• Experience running vulnerability management end to end, and automating it with code against scanner, ticketing, and source-control APIs
• You have shipped and maintained real software
• You read unfamiliar code quickly, review it rigorously, and reason about architecture and failure modes
• You take problems all the way through, including fixes that depend on other teams
• Code auditing in at least one of Go, Python, Node.js, Ruby, or Java, and the willingness to work in the rest
• Practical command of the OWASP Top 10, with real depth in broken access control and business logic flaws
• SAST, DAST, and SCA in CI/CD, tuned so engineers trust the output
• Cloud fundamentals on GCP or AWS
• Docker and Kubernetes
• Scaling security tooling across many repositories, languages, and build systems
• Prior experience writing custom static analysis rules (Semgrep, CodeQL, or similar)
• Fintech, payments, or other environments under serious third-party security review (PCI DSS, SOC 2, customer audits)
• Fully distributed, asynchronous engineering experience
• Offensive experience in whatever form you found it
• Pentesting on web, API, mobile, or cloud is the most directly relevant
• Hardware and embedded work, physical security and lock sport, red team engagements, protocol and radio work, and CTF or bug bounty results all count
• Advanced offensive certifications
• OSWE and BSCP are the most relevant; CPTS, CRTO, and similar also count
• Public work: research, tooling, disclosures, talks