Security Engineer, Application Security
Quartermaster29 days ago
USA (city not specified)Senior / Staff+
Responsibilities
- Lead threat modeling and secure design reviews for new and existing services.
- Perform white-box, grey-box, and black-box application security assessments and secure code reviews across web, API, cloud, and backend services.
- Build, integrate, and tune SAST, DAST, SCA, secret-scanning, and static-analysis tooling in CI/CD pipelines.
- Triage, prioritize, and drive remediation of application vulnerabilities with engineering teams.
- Develop secure-by-default automation, paved-road tooling, and developer self-service security capabilities.
- Define and mature the secure software development lifecycle, secure coding standards, and security requirements.
- Own or support vulnerability disclosure and bug bounty processes, including validation, root-cause analysis, and fix coordination.
- Strengthen software supply-chain security through dependency management, artifact and commit signing, and build and pipeline integrity.
- Partner with security operations on application-layer incidents and provide code-level investigation and remediation expertise.
- Deliver developer-focused security training and promote a security-aware engineering culture.
Requirements
- 5–8 years of experience in application security, product security, or software engineering with a strong security focus.
- Software development experience in one or more of Python, Go, Java, JavaScript/TypeScript, Rust, or C/C++, with the ability to reason about production code.
- Experience evaluating code for vulnerabilities and leading threat modeling and security design reviews.
- Hands-on experience with SAST, DAST, SCA, CodeQL, and CI/CD integration.
- Strong understanding of the OWASP Top 10, CWE, common vulnerability classes, and secure coding practices.
- Experience securing microservices or SOA architectures, REST or gRPC APIs, containers, and AWS, Azure, or GCP environments.
- Experience performing black-box and grey-box testing of web applications and APIs.
- Track record of driving vulnerability remediation in partnership with engineering teams.
- Strong written and verbal communication skills for technical and non-technical audiences.
- Must be a U.S. citizen.
- Bachelor’s degree in Computer Science, Cybersecurity, or equivalent hands-on experience.
- Preferred: active or attainable U.S. security clearance, relevant security certifications, secure-by-default frameworks, software supply-chain security, Terraform, Kubernetes, bug bounty or security research contributions, and experience with embedded, edge, robotics, IoT, defense, intelligence, or critical-infrastructure environments.
Benefits
- Competitive salary with comprehensive medical, dental, and vision benefits.
- Flexible remote work.
- Significant autonomy and career growth in a rapidly scaling defense-tech company.
- Opportunity to build application security for critical maritime and national-security infrastructure.
Tech Stack
Categories
About Quartermaster
Quartermaster builds a maritime intelligence platform that turns commercial and civilian vessels into a distributed sensing network via its SmartMast hardware, fusing HD video, radar, RF, AI, and AIS. It sells maritime domain awareness data and software to defense and government agencies, insurers, and energy and oceanography users. Founded in 2023 and headquartered in Arlington, Virginia, it has deployed 600+ sensors across 25+ countries and identified 400,000+ vessels outside AIS.