27 days ago
Base Salary
$135k - $180k/yr
Responsibilities
- Triage, validate, route, and drive remediation of findings from SAST, DAST, SCA, code reviews, penetration tests, and bug bounty programs.
- Build automation to reduce manual effort across the vulnerability-management pipeline using scanner, ticketing, and source-control APIs.
- Set scope for external penetration tests and bug bounty programs, direct testers, assess severity, and close the remediation loop.
- Identify recurring vulnerability patterns and eliminate root causes through secure defaults, reusable patterns, and engineering fixes.
- Write custom static-analysis rules for organizational anti-patterns.
- Review authorization, service identity, secrets-handling, and gateway-enforcement controls and drive gaps to closure.
- Perform hands-on application and API testing and manual code reviews of high-exposure services, with emphasis on authorization and business-logic flaws.
- Conduct threat modeling for new and high-exposure designs.
- Support security enablement across engineering, including a security champions program.
Requirements
- Experience running vulnerability management end to end and automating it with code.
- A software engineering background with experience shipping and maintaining production software, reading unfamiliar code, reviewing code, and reasoning about architecture and failure modes.
- Code-auditing experience in at least one of Go, Python, Node.js, Ruby, or Java, with willingness to work in the others.
- Practical command of the OWASP Top 10, especially broken access control and business-logic flaws.
- Experience with SAST, DAST, and SCA in CI/CD, plus cloud fundamentals on GCP or AWS, Docker, and Kubernetes.
- Ability to distinguish meaningful findings from theoretical ones and drive cross-team remediation to completion.
- Preferred experience includes scaling security tooling across repositories, languages, and build systems; writing custom static-analysis rules with Semgrep, CodeQL, or similar tools; and working in fintech, payments, or environments subject to PCI DSS, SOC 2, and customer audits.
- Preferred experience includes web, API, mobile, or cloud penetration testing; other offensive-security experience; OSWE, BSCP, CPTS, CRTO, or similar certifications; public research or tooling; and distributed asynchronous engineering experience.
Benefits
- Remote-first work from anywhere within the country of hire, with no required office attendance.
- Flexible paid time off and a year-end break.
- Health, dental, and vision coverage for employees and dependents in the US and Canada.
- 4% 401k or RRSP matching for employees in the US and Canada.
- MacBook Pro delivered to the employee's door.
- One-time home-office setup stipend.
- Monthly meal and social meet-up stipends.
- Annual health and wellness and learning stipends.
- Compensation includes cash and equity, with early exercise available for all options including pre-vested options.
Categories
About Sardine
Sardine builds an integrated fraud and anti–money-laundering platform for banks, fintechs, and online businesses, combining device fingerprinting, behavioral biometrics, session telemetry, and real-time transaction monitoring, with APIs and case management to block attacks and automate reviews. Privately held and founded in 2020, it is headquartered in San Francisco. Publicly named customers include FIS, GoDaddy, Intuit, Edward Jones, ZoomInfo, and Checkout.com.