Sr. Application Security Engineer
Extra Space Storage1 day ago
Salt Lake City, UT, USASenior
Responsibilities
- Conduct security architecture and design reviews for new and evolving software features.
- Perform threat modeling, white-box testing, manual code reviews, and automated code reviews, then partner with developers on remediation.
- Mature the Secure SDLC through secure coding standards, security requirements, and SAST, DAST, SCA, and secrets-scanning checks in delivery pipelines.
- Build and maintain application security tooling and automation across engineering teams.
- Lead and grow the security champions program and mentor engineers on secure development practices.
- Serve as the application security subject matter expert for engineering, product, and leadership.
- Assess risks associated with AI tools, AI-powered features, agentic systems, MCP, and LLM-powered workflows.
- Align applications with SOC 1, SOX, CIS v8, and PCI DSS and support audits with evidence and remediation plans.
Requirements
- At least 6 years of combined experience in software engineering, application security, product security, or a closely related field.
- Proficiency in most primary languages, including C# .NET, TypeScript, JavaScript, and SQL.
- Experience securing modern web applications and cloud-native architectures, particularly on AWS.
- Hands-on white-box testing and secure code review experience.
- Strong understanding of SSDLC principles and experience implementing or maturing secure development programs.
- Knowledge of common vulnerabilities and attack techniques, including OWASP Top 10, API security, and authentication and authorization flaws.
- Experience integrating security tooling into delivery pipelines such as GitHub or TeamCity.
- Familiarity with AI security risks and emerging attack surfaces, including agentic systems, MCP, and LLM-powered workflows.
- Ability to explain security risk in business terms, build trusted engineering relationships, and guide behavior without direct authority.
- Strong written and verbal communication skills.
- Preferred experience with Next.js, Vercel, or serverless architectures.
- Preferred knowledge of OWASP ASVS, NIST 800-53, CIS v8, PCI DSS, or SOX.
- Preferred security certifications such as OSCP, BSCP, GWEB, PNPT, or similar.
- Preferred experience running or triaging a bug bounty program.
- A bachelor's degree in Computer Science, Information Security, or a related field is preferred.
Benefits
- Hybrid work arrangement requiring two days per week at the Cottonwood Heights office in SLC.
- Work is performed in a sedentary office environment with limited lifting or walking and no exposure to adverse environmental conditions.
Tech Stack
Categories
About Extra Space Storage
Extra Space Storage is a public real estate investment trust (REIT) that acquires, develops, owns, and manages self-storage facilities for consumers and businesses. It earns revenue by renting storage units and vehicle spaces, offering tenant insurance, and providing third‑party management services. Founded in 1977 and headquartered in Salt Lake City, it trades on the NYSE under the ticker EXR and operates a nationwide network of properties.