Sr. Application Security Engineer
Senior
Ai Security
Application Security
Application Security Testing
Automated Security Testing
Cloud Platforms
Dynamic Application Security Testing
Information Security
InfoSec
Risk Management
Secrets Scanning
Secure Sdlc
Security
Security Automation
Security Compliance
Security Standards
Security Testing
Software Security
Static Application Security Testing
Static Code Analysis
Threat Modeling
Job Description
Extra Space Management, Inc offers a hybrid engineering environment in Salt Lake City, UT, with the expectation that application security is built into everyday software development and delivery. In this role, you will work closely with product and engineering teams to reduce risk early, improve how security is implemented in CI/CD, and help teams adopt secure practices at scale.
What you’ll do
- Lead security architecture and design reviews for new and evolving features, surfacing risk early and recommending practical mitigations.
- Run threat modeling and perform manual and automated code reviews, partnering with developers to prioritize and remediate findings.
- Use a risk-based approach to application security, explaining vulnerabilities in terms of business impact.
- Help mature a Secure SDLC by defining secure coding standards, security requirements, and integrating automated checks into CI/CD pipelines using SAST, DAST, SCA, and secrets scanning.
- Build and maintain security tooling and automation that scales across teams, focused on reducing risk rather than adding unnecessary tools.
- Drive and grow a security champions program, training champions so security expertise is available close to each team.
- Serve as the application security subject matter expert for engineering, product, and leadership, including mentoring engineers on secure development practices.
- Support the adoption of AI tools and AI-powered features within acceptable risk limits.
- Align applications with SOC 1, SOX, CIS v8, and PCI DSS (including SAQ-A and SAQ-P2PE), and support audits with evidence and remediation plans.
What you bring
- 6+ years of combined experience in software engineering, application security, product security, or a closely related field.
- Proficiency in most primary languages used at the company: C# .NET, TypeScript, JavaScript, and SQL.
- Experience securing web applications on modern frameworks and cloud-native architectures, particularly AWS.
- Hands-on experience with white-box testing and secure code review.
- Strong understanding of SSDLC principles, including implementing or maturing secure development programs.
- Solid knowledge of common vulnerabilities and attack techniques, including OWASP Top 10, API security, and authentication and authorization flaws.
- Experience integrating security tooling into delivery pipelines such as GitHub and TeamCity (or similar).
- Familiarity with AI security risks and emerging attack surfaces, including agentic systems, MCP, and LLM-powered workflows.
- A risk-focused mindset, able to discuss security in business terms and guide pragmatic decisions.
- Proven ability to build trusted relationships and influence security practices without direct authority.
- Strong written and verbal communication, comfortable with both design reviews and risk conversations with leadership.
Helpful experience
- Development experience with Next.js, Vercel, or serverless architectures.
- Practical knowledge of frameworks and standards such as OWASP ASVS, NIST 800-53, CIS v8, PCI DSS, or SOX.
- Hands-on security certifications such as OSCP, BSCP, GWEB, PNPT, or similar.
- Experience running or triaging a bug bounty program.
- Bachelor’s degree in Computer Science, Information Security, or a related field.
Tools and technologies
- AWS, Vercel, C# .NET, TypeScript, JavaScript, React/Next.js, SQL Server, SQL
- SAST, DAST, SCA, secrets scanning, CI/CD, GitHub, TeamCity
- SOC 1, SOX, CIS v8, PCI DSS, SAQ-A, SAQ-P2PE
- OWASP Top 10, API security, SSDLC, agentic systems, MCP, LLM-powered workflows, secure coding standards
Work environment
- Sedentary work in an office environment, with limited lifting (less than 10 pounds) or walking required.
- Close visual acuity required to work at a computer terminal.
- No exposure to adverse environmental conditions.
- Requires repetitive typing motion, talking, hearing, grasping and feeling.
Applications deadline: Applications will be accepted until the position is filled.
Similar Jobs
