Sr. Application Security Engineer

Contenido del rol extraído en secciones para revisar más rápido.

Lead AppSec Strategy: Own the end-to-end security of the Material application, from design and threat modeling to deployment.
Vulnerability Management: Secure our dependency supply chain while working directly with engineering.
Build Security Tooling: Develop internal automation to detect and block abuse patterns and streamline security workflows (e.g., JIT access, dependency scanning).
Code & Architecture Review: Perform deep-dive security audits and code reviews for new and existing product features.
Infrastructure Security: Partner with the infrastructure team to harden our Kubernetes deployments and cloud environments (GCP).

Technical Depth: 5+ years of experience in application security, including significant time spent writing and reviewing code.
Software Engineering Skills: Proficiency in more than more than one major coding language. Preferably (but not required), that set would include Javascript/Typescript. You should be comfortable contributing directly to the codebase.
Cloud & Containers: Practical experience securing cloud environments (GCP preferred) and a strong understanding of Kubernetes security.
Systems Thinking: A deep understanding of identity and access management (SAML, OAuth, IAM) and how to protect sensitive data at rest and in transit.
Pragmatism: The ability to balance security risks with business velocity. You should be able to propose creative "middle ground" solutions that reduce risk without blocking progress.
Versatility: A willingness to jump into areas adjacent to traditional AppSec—e.g data analysis in BigQuery or learning about protecting against prompt injection —to get the job done.

Roles similares