Staff/Lead Application Security Engineer

Beacon Holdings is hiring its first dedicated application security engineer to establish product security strategy and build an application security program across Beacon and its portfolio companies. The application security surface spans multiple codebases, each with its own stack and engineering team, so this role blends deep technical application security with program ownership and team enablement.

Based in San Francisco, CA (onsite), you will embed with teams that design and ship product work, owning the technical roadmap for product security as Beacon grows. This is the full remit of application security at Beacon, from standards and tooling to incident support and evidence for customer and audit needs.

What you will do

• Lead threat modeling and security architecture review for new product work and platform initiatives, defining standards for authentication, authorization, encryption, and tenant isolation.
• Own product security review of newly acquired codebases and cloud environments, establishing baseline posture, material risk, and a clear remediation path.
• Perform secure code reviews, focusing on authorization and business logic flaws that automated tooling does not catch.
• Identify and manage the external partner that performs penetration testing, then drive remediation of findings.
• Assess AI features across Beacon’s products, including agent architectures, model and tool access, delegated credentials, and the data reachable through them.
• Own the end-to-end application security program, including intake, severity, prioritization, remediation SLAs, and reporting, and drive fixes through engineering teams in ways they can sustain.
• Own standards for SAST, DAST, SCA, and secrets scanning, including integration into CI/CD across the portfolio.
• Build automation to support a multi-team portfolio, including routine fix PRs, dependency remediation, and findings routing.
• Own security for internal tools you build, including access to credentials, source code, and production systems.
• Write secure coding standards and training that engineering teams consult before they build.
• Serve as the product security expert during incidents, supporting investigation through remediation and postmortem.
• Work with GRC to produce evidence for audit and customer security review requirements, while ensuring compliance does not dictate the security roadmap.
• Set the strategy for product security and begin building the application security program from the ground up.

Role expectations

• Prefer building systems that find many instances of bugs rather than fixing issues one at a time.
• Already uses AI in their workflow with real judgment about where it helps, where it does not, and when to build versus buy tooling.
• Can set architecture and standards across many codebases, not only review work in isolation.
• Ships production code personally, with ability to author fixes rather than only specify them.
• Has expert knowledge of web and API security, identity and access design (authentication, authorization, RBAC/ABAC), and applied cryptography.
• Has experience securing applications in cloud environments and containerized workloads.
• Has a track record of driving security work to completion in engineering organizations outside their direct reporting line.

Technologies

• SAST
• DAST
• SCA
• secrets scanning
• CI/CD
• RBAC
• ABAC

Beacon software values

• Humility: beliefs are weakly held, learning is continuous, and the team actively seeks new ideas.
• Honesty: truth-seeking and long-term trust built through relationships.
• Hunger: high standards, ownership, and pride in responsibility to partners and customers.
• Horizon: focus on building a generational software company over decades.

How Beacon uses AI in hiring

Beacon uses Artificial Intelligence and AI-enabled tools to assist with screening, reviewing, organizing, and highlighting profiles and applications that match key requirements for each role.

AI does not make hiring decisions. Every application is reviewed by a member of the team, and all decisions are made by humans to ensure a fair, thoughtful, and equitable candidate experience.