Application Security Engineer

SpaceXSI is hiring an Application Security Engineer to help safeguard cloud-native applications and systems across the software development lifecycle. The focus spans secure code practices, CI/CD pipeline security, and security work for AI-related applications, including the OWASP LLM Top 10.

What you’ll do

• Perform in-depth code reviews and static analysis to find and mitigate vulnerabilities across applications
• Design and implement secure coding guidelines and development-team best practices
• Partner with development teams to embed security into the CI/CD pipeline and support DevSecOps workflows
• Conduct threat modeling and risk assessments, then define mitigation strategies for identified risks
• Own vulnerability tracking and remediation, including providing guidance to development teams
• Support incident response activities related to application security
• Continuously monitor emerging threats and trends in cloud-native technologies and AI to strengthen security measures
• Evaluate and secure software supply chains, producing and maintaining Software Bills of Materials (SBOMs)
• Address security risks specific to AI and machine learning models, with emphasis on the OWASP LLM Top 10

Required qualifications

• Bachelor’s degree in Computer Science, Cybersecurity, or a related field
• 3-5 years of experience in application security with a strong focus on code security
• Deep understanding of secure coding practices, application security frameworks, and common vulnerabilities (including OWASP Top 10)
• Proficiency in Python or Rust, including applying secure coding practices in these languages
• Experience securing CI/CD pipelines and implementing DevSecOps practices
• Familiarity with software supply chain security and SBOM generation tools
• Experience with security testing tools such as Burp Suite and OWASP ZAP, plus static and dynamic code analysis
• Understanding of AI/ML security implications, particularly those in the OWASP LLM Top 10
• Strong communication skills to explain complex security issues to both technical and non-technical audiences

Technologies you may work with

• Python, Rust
• Burp Suite, OWASP ZAP
• SBOM
• GCP, AWS, Azure

Preferred skills and experience

• Experience with cloud platforms (including GCP, AWS, Azure) and their security features
• Relevant security certifications such as CSSLP and OSWE
• Background in data privacy and compliance regulations for cloud-native applications and AI systems
• Experience with GitOps and infrastructure-as-code security
• Familiarity with federated learning and privacy-preserving machine learning techniques
• Experience building custom security tooling to enhance and automate security processes
• Interest in using AI to automate security tasks and improve efficiency
• Contributions to open-source security projects or tools
• Experience securing AI/ML models and data pipelines

Compensation and benefits

$100,000 - $258,000 USD per year. Base salary is part of SpaceXSI’s total rewards package, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks.

Location: Palo Alto, CA (onsite)