2 of 3,137 remote jobs

Featured, then newest

Filters

Senior Application Security Engineer

Sardine

United States

today

Product Security Engineer

WorkOS

United States & Canada

today

That’s every role matching this search.

Senior Application Security Engineer

Sardine

United StatesListed todayPosted by the employer Oct 15, 2026Listing ends Dec 29, 2026

Compensation: $135k–$180k
Location: United States
Fully remoteMore jobs: United States
Employment: Full-time
Category: Security

Role skills

static analysis threat modeling vulnerability management go python java automation node.js

Apply on jobs.ashbyhq.comExternal application — you finish on the employer's site.

Tailor my résumé Apply now

About the job

5 min read12 sections

Who we are

Sardine is the leading agentic risk platform for fighting financial crime. Our integrated solution unifies data across risk teams to help organizations stop fraud in real time, prevent AI-driven attacks, and automate fraud and AML operations. Sardine’s platform is strengthened by one of the fastest-growing fraud consortiums in the market, spanning more than 6 billion profiled devices, 800 million consumers, and 3 million businesses worldwide. Leading companies including FIS, GoDaddy, Intuit, Edward Jones, ZoomInfo, and Checkout.com rely on Sardine to secure and grow trust in their products.

Our culture

We hire talented, self-motivated individuals with extreme ownership and high growth orientation.
We value performance and not hours worked. We believe you shouldn't have to miss your family dinner, your kid's school play, friends get-together, or doctor's appointments for the sake of adhering to an arbitrary work schedule.
We're a remote-first team spread across time zones, so no office to report to - work from wherever helps you do your best work. Just a couple of things to keep in mind: pay is based on where you're located, and you'll need to keep a home base in the country you're hired in. So while we love the "coffee shop today, mountains tomorrow" life, this isn't a passport-optional, work-from-anywhere-on-Earth kind of remote - think flexible within your country, not borderless.

Location

Remote - United States

THE ROLE

Sardine makes risk and payment decisions for banks and fintechs. Our customers audit us closely, and application security is a large part of what they examine.

Money moves through this platform, so real adversaries study it. Your job is to find what they would find, especially authorization flaws and business logic abuse, and then make the whole class of bug go away.

The application security team is small. The estate is large: Go, Node.js, Python, Ruby, and Java services running on multi-cloud and Kubernetes. That ratio shapes the work. Findings arrive from scanners, code review, testing, threat modeling, pentesters, and bug bounty hunters. You turn that stream into a pipeline that validates, routes, and closes issues with as little manual effort as possible. Then you use what the pipeline tells you to remove root causes: secure defaults, patterns engineers reach for first, and fixes that hold.

Little here is pre-decided. You determine where the risk is and go after it.

THE WORK

WHERE MOST OF YOUR TIME GOES

RUNNING AND AUTOMATING THE VULNERABILITY PIPELINE

Triage, validate, route, and drive remediation of findings from every source: SAST, DAST, SCA, code review, pentests, and bug bounty
Build the automation that removes manual effort from each of those steps
External pentests and bug bounty program: set scope, direct the testers, judge severity, and close the loop

MAKING BUG CLASSES GO AWAY

Spot the patterns across findings and remove the root cause, not just the instance
Set the secure patterns and defaults that make the right way the easy way
Write custom static analysis rules for our own anti-patterns, so a fixed bug class stays fixed
Review platform-layer controls (authorization, service identity, secrets handling, gateway enforcement), find the gaps, and push the owning teams until they are closed
Work alongside engineers on fixes that are simple, get adopted, and hold

ALSO PART OF THE JOB

Hands-on testing of our applications and APIs, and manual code review of high-exposure services, with depth in authorization and business logic
Threat modeling on new and high-exposure designs
Security enablement across engineering, including a security champions program

WHAT WE'RE LOOKING FOR

Vulnerability management, automated. Experience running vulnerability management end to end, and automating it with code against scanner, ticketing, and source-control APIs
An engineering background. You have shipped and maintained real software. You read unfamiliar code quickly, review it rigorously, and reason about architecture and failure modes.
Ownership to done. You take problems all the way through, including fixes that depend on other teams. You follow up on the fix you recommended three sprints ago.
Judgment over tenure. We care more about the depth of your judgment than your years of experience.
Code auditing in at least one of Go, Python, Node.js, Ruby, or Java, and the willingness to work in the rest
Practical command of the OWASP Top 10, with real depth in broken access control and business logic flaws
SAST, DAST, and SCA in CI/CD, tuned so engineers trust the output. Cloud fundamentals on GCP or AWS. Docker and Kubernetes.
You separate real findings from theoretical ones.
You disagree in the open, with evidence, and update when someone brings better evidence.
Your influence travels asynchronously, across time zones, to people with strong opinions and no reporting line to you.

BONUS

Scaling security tooling across many repositories, languages, and build systems
Prior experience writing custom static analysis rules (Semgrep, CodeQL, or similar)
Fintech, payments, or other environments under serious third-party security review (PCI DSS, SOC 2, customer audits)
Fully distributed, asynchronous engineering experience
Offensive experience in whatever form you found it. Pentesting on web, API, mobile, or cloud is the most directly relevant. Hardware and embedded work, physical security and lock sport, red team engagements, protocol and radio work, and CTF or bug bounty results all count.
Advanced offensive certifications. OSWE and BSCP are the most relevant; CPTS, CRTO, and similar also count.
Public work: research, tooling, disclosures, talks

Benefits we offer

Generous compensation in cash and equity
Early exercise for all options, including pre-vested
Work from anywhere: Remote-first Culture
Flexible paid time off and Year-end break
Health insurance, dental, and vision coverage for employees and dependents - US and Canada specific
4% matching in 401k / RRSP - US and Canada specific
MacBook Pro delivered to your door
One-time stipend to set up a home office — desk, chair, screen, etc.
Monthly meal stipend
Monthly social meet-up stipend
Annual health and wellness stipend
Annual Learning stipend

Join a fast-growing company with world-class professionals from around the world. If you are seeking a meaningful career, you found the right place, and we would love to hear from you.

To learn more about how we process your personal information and your rights in regards to your personal information as an applicant and Sardine employee, please visit our Applicant and Worker Privacy Notice https://www.sardine.ai/applicant-and-worker-privacy-notice.

Role signals

Benefits: , , , , , , , , , ,

About Sardine

Sardine provides a risk platform to fight financial crime, offering solutions for fraud prevention, AML compliance, and real-time transaction monitoring. The pl…Based on an AI summary from sardine.ai