Senior Application Security Engineer

<p>Unqork empowers enterprises to accelerate growth by rapidly building, testing, and running applications that are designed to be AI-native. Trusted by the world’s largest organizations in highly regulated industries, these applications become more secure over time while significantly reducing technical debt—allowing businesses to focus on innovation rather than maintenance. Unqork’s customers include Goldman Sachs, Marsh, BlackRock, and the U.S. Department of Health and Human Services. </p> <p><em>At Unqork, we value inclusive and innovative thinkers who boldly challenge the status quo. We encourage you to apply! </em></p> <p><strong>Role Overview: </strong></p> <p>You will be part of a team that is passionate about securing Unqork's Commercial and FedRAMP technology stack. </p> <p>You will champion application security best practices and drive their adoption across Unqork's engineering organizations. You will automate processes using policy as code. You'll leverage your deep technical expertise to oversee the identification and remediation of security vulnerabilities and misconfigurations. In this role, you will be responsible for identifying vulnerabilities, providing remediation guidance, and fostering a culture of Security by Design.</p> <p>This is a technical, hands-on role requiring a mix of manual penetration testing, automated tool management, and deep code-level analysis. You will work side-by-side with our engineering teams to ensure our application and infrastructure remain resilient against modern threats. </p> <p><strong>The Impact U will make: </strong></p> <ul> <li><strong>Vulnerability Management:</strong> Perform deep-dive manual penetration testing and security assessments on web applications to identify flaws beyond the reach of automated tools.</li> <li><strong>Tool Orchestration:</strong> Triage and manage results from <strong>SAST</strong> (Static), <strong>DAST</strong> (Dynamic), and <strong>SCA</strong> (Software Composition Analysis) tools, reducing false positives and prioritizing critical risks.</li> <li><strong>Code Review:</strong> Conduct thorough security code reviews of <strong>Node.js</strong> applications to identify logic flaws, injection vulnerabilities, and broken access controls.</li> <li><strong>Automation:</strong> Develop <strong>Python</strong> scripts to automate repetitive security tasks, integrate security checks into CI/CD pipelines, and enhance our internal security tooling.</li> <li><strong>Remediation Partnership:</strong> Act as a security consultant for developers, tracking vulnerabilities from discovery through to successful remediation and verification.</li> <li><strong>Standardization:</strong> Stay current with the <strong>OWASP Top 10</strong> and other industry frameworks to ensure our defense strategies evolve with the threat landscape. </li> </ul> <p><strong>What U bring:</strong></p> <ul> <li><strong>Experience: </strong>5+ years in Application Security, Pentesting, or Security Engineering.</li> <li><strong>Technical Core:</strong> Expert knowledge of the OWASP Top 10 and common web attack vectors (XSS, SQLi, SSRF, etc.). Must be able to explain the root cause and remediation of all OWASP vulnerabilities. Experience with testing AI/LLM applications, with a deep understanding of all OWASP LLM Top 10 vulnerabilities.</li> <li><strong>Development: </strong>Proficiency in reading and auditing Node.js code; ability to write automation scripts in Python.</li> <li><strong>Testing Tools:</strong> Experience with Burp Suite Professional, OWASP ZAP, and commercial SAST/DAST/SCA platforms. </li> <li><strong>Soft Skills: </strong>Excellent communication skills with the ability to explain complex security concepts to non-security stakeholders.</li> </ul> <p><br><br></p> <p><strong>Compensation, Benefits, Perks</strong></p> <p>💻 Work from home with a remote-first community</p> <p>🏝 Unlimited PTO (and the encouragement to use it)</p> <p>📝 Student loan payback program</p> <p>🏥 ... (truncated, view full listing at source)