Base Salary
$180k - $210k/yr
Responsibilities
- Conduct manual penetration testing, exploit development, authenticated web and API testing, and adversarial design reviews.
- Lead threat modeling and secure design reviews for high-risk initiatives and mentor engineers on secure design.
- Own and evolve AppSec tooling for SAST, DAST, SCA, secret scanning, IaC scanning, and CI/CD security gates.
- Build custom security rules, detections, automation, tools, scripts, and integrations to reduce triage effort.
- Review AWS configurations, IAM policies, Kubernetes/EKS workloads, and network boundaries while building cloud security guardrails.
- Partner with Infrastructure and Platform teams on detection engineering, incident response support, secrets management, supply-chain security, and runtime security.
- Set technical standards for the AppSec team, mentor peers, and represent AppSec in architecture reviews, vendor evaluations, and compliance efforts.
Requirements
- At least 8 years of hands-on experience in application security, offensive security, or security engineering.
- Demonstrated depth in at least two areas: offensive testing, security tooling and automation, or cloud and infrastructure security.
- Strong manual exploitation skills for web and API vulnerabilities, along with the ability to teach others.
- Experience building and operating SAST, DAST, SCA, secrets-scanning, and CI/CD security tooling and custom detection rules.
- Production experience with AWS, IAM, VPC, networking, data services, Docker, Kubernetes/EKS, and infrastructure as code such as Terraform.
- Ability to read, review, and contribute code in Python, Go, Ruby, TypeScript, or a similar language.
- Experience in a regulated industry, bug bounty participation, identity and access systems, detection engineering, DFIR, red teaming, security-tooling open source, published research, CVE credits, or certifications such as OSCP, OSWE, GWAPT, or GPEN is preferred but not required.
Benefits
- Remote work eligible, with offices in San Francisco, Concord, and Austin.
- Health plans, 401(k), commuter benefits, professional development, parental leave, and flexible time off.
- Robust online onboarding program, biweekly all-hands meetings, and internal virtual events.
Tech Stack
Categories
About Qualia
Qualia is the connected title, escrow, and closing technology infrastructure built for real estate and mortgage professionals. The platform makes buying and selling a home a simple, secure, and enjoyable experience by bringing together homebuyers and sellers, mortgage lenders, title & escrow agents, and real estate agents onto a single shared closing system. Over 1 million real estate and mortgage professionals use Qualia to power their real estate closings, and we currently process transactions for millions of consumers every year. Since launching in 2015, the company has been named an ALTA Elite Provider, CB Insights Fintech 250, Fast Company’s Next Big Thing in Tech, and has been recognized by Forbes as a Best Startup Employer. Qualia is headquartered in San Francisco, CA and has offices in Austin, TX, and Superior, CO.