Staff Security Engineer, Application Security
Fomo Labs · New York City
About this role
**ABOUT FOMO** FOMO is a trading app for the rest of us—sign up in seconds and start trading right away (no prior experience needed). Our social features are actually useful: follow top traders, see their full portfolios and trades, and find opportunities early. Under the hood, we deliver best-in-class execution and data for experienced traders. - Over **3.4M+ users** onboarded in just over a year - **$28B+** collective trading volume - **$100M+** revenue since launching (May 2025) - Raised **~$100M** from T1 investors (Benchmark, Index Ventures, Union Square Ventures) Website: https://fomo.family/ X: https://x.com/fomo **ABOUT THE ROLE** We’re hiring a **Staff Security Engineer** to own and elevate our **application security (AppSec) program**. This is a hands-on, high-leverage role where you’ll be the technical authority on how we build secure software—not someone who only reviews tickets after the fact. You’ll be embedded in how our product is designed, built, and shipped (product/application security focus; not corporate IT, endpoint management, or employee-facing security ops). **WHAT YOU’LL DO** - Lead **security architecture reviews** and **threat modeling** for new features and major system changes (design → launch) - Own our **secure SDLC** program: **SAST/DAST**, dependency/SCA, **secrets scanning**, and **CI/CD security gates** - Perform deep-dive **code reviews** and **manual penetration testing** of high-risk services, APIs, and web apps - Design and build internal **security tooling and guardrails** that help engineers move fast safely - Mature **vulnerability management**: triage, severity scoring, and driving remediation with engineering owners - Manage relationships with **external pentest vendors** and **bug bounty programs**, turning findings into durable fixes - Set technical direction on **authentication, authorization, API security, and data protection** patterns - Mentor engineers on secure coding practices; be a go-to resource for security questions - Contribute to **incident response** for application-layer issues - Help define and evolve our **AppSec roadmap and metrics** **WHAT WE’RE LOOKING FOR** - **7+ years** in security engineering, with substantial and recent focus on **application security** (not primarily corporate/IT security) - Deep hands-on experience with **secure code review**, **threat modeling**, and common vulnerability classes (OWASP Top 10, auth/session flaws, SSRF, injection, business logic flaws, etc.) - Strong software engineering background—comfortable reading/writing production code (not just running scanners) - Experience building/scaling **AppSec tooling and processes** (SAST/DAST, SCA, CI/CD security integration) - Track record of driving security into engineering culture through **influence**, not gatekeeping - Familiarity with **cloud-native environments** (AWS/GCP/Azure), container security, and modern API architectures - Excellent communication skills—able to explain risk to engineers and non-technical stakeholders - Prior experience as a **technical lead** or staff-level IC with high autonomy **NICE TO HAVE** - Experience managing **bug bounty programs** - Background in a high-growth **consumer** or **marketplace** product **WHY FOMO** Be the first dedicated AppSec hire shaping the security foundation of a company at real scale—with autonomy to set standards. **COMPENSATION & BENEFITS** - Competitive cash compensation and equity - Comprehensive health insurance (medical/d
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.