Senior Application Security Engineer II
Spring Health3 months ago
Base Salary
$180k - $206k/yr
Responsibilities
- Advance secure-by-design practices through architecture reviews, design consultations, and security guidance across the software development lifecycle.
- Mentor engineers on secure coding, application security fundamentals, and career growth.
- Develop an AI-assisted threat modeling program covering risk identification, security architecture, tooling, methodology, and organizational adoption.
- Mature SAST, SCA, and DAST programs through rule tuning, noise reduction, coverage improvements, and stronger security controls.
- Perform security-focused code reviews of internal and open-source libraries and prioritize findings by exploitability and business impact.
- Support vulnerability remediation by assessing impact, proposing solutions, and validating fixes.
- Implement security automation and AI tooling integrations using Go, Python, JavaScript, or Ruby.
- Assess AI-integrated product features, including LLM APIs, vector databases, and RAG pipelines, for prompt injection, data leakage, and model supply-chain risks.
- Research, design, and develop a Secure AI Development Lifecycle aligned with the OWASP Top 10 for LLM Applications and emerging adversarial ML guidance.
- Evaluate and recommend AI-assisted security tools such as AI-augmented SAST and LLM-powered code review.
Requirements
- At least 7 years of professional experience in application security or a closely related security engineering discipline.
- Hands-on experience with DAST, SAST, SCA tools, and manual testing techniques based on OWASP and the SANS Top 25.
- Experience securing CI/CD pipelines with commercial and custom-built tooling.
- Experience with IaaS cloud infrastructure such as AWS, Azure, or GCP, as well as container technologies and service-oriented architectures.
- Security automation experience with at least one of Go, Python, JavaScript, or Ruby.
- Familiarity with AI/ML security concepts including prompt injection, adversarial inputs, model supply-chain risks, and the OWASP LLM Top 10.
- Working knowledge of AI and LLM tooling such as OpenAI, Anthropic, or LangChain for security assessment and workflow integration.
- Experience implementing controls aligned to NIST CSF, HIPAA, HITRUST, ISO-27001, or SOC-2.
- Bachelor’s degree in Computer Science, Engineering, MIS, or IT, or equivalent work experience.
- Strong cross-functional collaboration experience with engineering, product, and leadership stakeholders.
- Preferred: at least 3 years of security architecture experience.
- Preferred: experience developing formal threat modeling programs, evaluating AI security tooling, managing bug bounty or vulnerability disclosure programs, or working in digital health or HIPAA-regulated environments.
Benefits
- Full-time, fully remote position for candidates residing within the United States, with occasional travel to the New York City headquarters possibly required.
- Health, dental, and vision benefits begin on the first day; One Medical access and HSA/FSA plans are available, with employer HSA contributions up to $1,000 depending on plan type.
- Employer-sponsored 401(k) match of up to 2%.
- Yearly allotment of no-cost visits to Spring Health therapists, coaches, and medication management providers for employees and dependents.
- Paid vacation, sick leave, and company holidays.
- After six months of tenure, parental leave is 18 weeks for birthing parents and 16 weeks for non-birthing parents.
- Access to Noom, Carrot fertility care support with up to $4,000 reimbursement, Wellhub, and BrightHorizons sponsored care services.
- Up to $1,000 per year in professional development reimbursement.
- Up to $200 per year in donation matching.
Tech Stack
Categories
About Spring Health
Spring Health provides employers and health plans with a behavioral-health benefits platform that triages members and delivers care via self-guided tools, coaching, therapy, psychiatry, and EAP services. The service uses assessments and machine learning to match people to care and includes Care Navigators who coordinate appointments and community resources. Founded in 2016 and headquartered in New York City, the privately held company has outcomes independently validated by JAMA Network Open and the Validation Institute.