3 days ago
Base Salary
$214k - $245k/yr
Responsibilities
- Own Upside’s application security program, standards, vulnerability management pipeline, and preventive engineering guardrails.
- Triage and tune findings from scanning, code review, and annual penetration testing, then partner with engineering teams to ship and verify fixes.
- Lead application security reviews and threat models for high-impact mobile, web, and backend systems.
- Review and threat model agentic AI workflows and define controls for tool use, data access, and action execution.
- Build automation that triages findings, prioritizes them using service context, and produces actionable remediation guidance.
- Create scalable security controls including repository baselines, required GitHub checks, secure-by-default AWS patterns, reusable templates, and a security champions program.
Requirements
- 6+ years of application or product security experience, or equivalent depth in secure software engineering with meaningful application security ownership.
- Strong Python code review skills, including the ability to inspect AWS Lambda code and explain security issues and remediations to engineers.
- Demonstrated experience shipping security improvements that reduced real risk and driving verified remediation across teams.
- Experience with threat modeling and secure design reviews before systems ship.
- Practical, everyday use of AI in security work.
- Working knowledge of AWS security, including Lambda, API Gateway, IAM least privilege, and secrets handling.
- Working knowledge of CI/CD security in GitHub Actions, with depth in underlying security mechanics.
Benefits
- Medical, dental, and vision coverage beginning on Day 1.
- Equity through ISOs and a 401(k) program.
- Family planning programs and paid parental leave.
- Physical fitness and wellness memberships plus emotional and mental health support programs.
- Unlimited PTO, 10 paid federal holidays, and an annual week-long Winter Break.
- Flexible work environment and lunch reimbursement for in-office employees.
- Employee Resource Groups and a Learning and Development stipend.
