Senior Application Security Engineer
Sardine · United States
About this role
## Senior Application Security Engineer (Remote - United States) ### Who we are Sardine is the leading agentic risk platform for fighting financial crime. Our integrated solution unifies data across risk teams to help organizations stop fraud in real time, prevent AI-driven attacks, and automate fraud and AML operations. We’re remote-first, performance-oriented, and hire people with extreme ownership and high growth orientation. ### The role Sardine makes risk and payment decisions for banks and fintechs. Because money moves through the platform, real adversaries study it—so application security is a core part of what our customers audit. You’ll find what attackers would find (especially authorization flaws and business logic abuse), then eliminate entire classes of bugs—not just individual instances. You’ll work with a small application security team across a large estate: **Go, Node.js, Python, Ruby, and Java** services running on **multi-cloud** and **Kubernetes**. Findings come from scanners, code review, testing, threat modeling, pentesters, and bug bounty hunters. Your job is to turn that stream into an automated pipeline that validates, routes, and closes issues with minimal manual effort—then use the pipeline’s signals to remove root causes. ### What you’ll do **1) Run and automate the vulnerability pipeline** - Triage, validate, route, and drive remediation of findings from **SAST, DAST, SCA, code review, pentests, and bug bounty** - Build automation that removes manual effort from each step - Manage external pentests/bug bounty: set scope, direct testers, judge severity, and close the loop **2) Make bug classes go away** - Spot patterns across findings and remove root causes - Set secure patterns and defaults so the right way is the easy way - Write custom static analysis rules for your anti-patterns to keep bug classes fixed - Review platform-layer controls (authorization, service identity, secrets handling, gateway enforcement), find gaps, and push ownership teams until closed - Partner with engineers on fixes that are simple, adopted, and durable **3) Also part of the job** - Hands-on testing of applications and APIs + manual code review of high-exposure services (deep focus on authorization and business logic) - Threat modeling for new and high-exposure designs - Security enablement across engineering (including a security champions program) ### What we’re looking for - **Vulnerability management, automated**: experience running end-to-end vulnerability management and automating it with code (scanner, ticketing, and source-control APIs) - **Engineering background**: you’ve shipped and maintained real software; you can read unfamiliar code quickly and reason about architecture and failure modes - **Ownership to done**: you drive problems through to fixes, including cross-team dependencies, and follow up on outcomes - **Judgment over tenure** - **Code auditing** in at least one of: **Go, Python, Node.js, Ruby, Java** (and willingness to work across the rest) - Practical depth in **OWASP Top 10**, especially **broken access control** and **business logic flaws** - **SAST/DAST/SCA in CI/CD**, tuned so engineers trust the output - Cloud fundamentals on **GCP or AWS**; **Docker** and **Kubernetes** - Ability to separate real findings from theoretical ones - Evidence-based disagreement and willingness to update with better evidence - Influence across time zones without a reporting line ### Bonus (nice to have) - Scaling
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.