Senior Application Security Engineer
Save this role or tell us whether you want more jobs like it.
Description
About Cyera
Come join the company building the security operating model for the age of AI. AI has changed how data is used — and security must change with it. Cyera's mission is to empower businesses to accelerate AI Adoption by defining a holistic approach to securing AI - from data to access to model. Instead of perimeter controls and static policies, Cyera provides a unified control plane that understands relationships between data, access, and behaviors across humans, systems, and AI. Backed by the world’s leading investors and working with a large and growing list of Fortune 1000 companies, we are looking for world-class talent to join us as we usher in the new era of data and AI security.ty job that is used for creating requisitions 'from scratch'
About the Role
Join our team as a Senior Application Security Engineer. You will be a senior technical leader in the application security program, working with R&D teams to build security into how we design, build, and ship our products. You will report to the Head of Application Security and act as the technical lead for some of the program’s most important workstreams.
You will help build a modern product security program that uses automation, pipeline integration, and AI-assisted workflows rather than manual review alone. You will turn standards into guardrails engineers can use, find and fix real risk in our code and architecture, and make secure development the easy path.
The ideal candidate has 6–9 or more years of cybersecurity experience, including at least 4 years in application security, strong software engineering skills, and a record of influencing engineering teams and mentoring other engineers. We are looking for someone who is credible in the code, clear in their communication, and focused on outcomes.
What You’ll Do
- Code and Design Review: Review high-risk code and designs, and help engineers fix issues at the root rather than one finding at a time.
- Pipeline Security: Build and tune security checks in CI/CD, including static and dynamic analysis, dependency and container scanning, and secrets detection, with a focus on accuracy and low noise.
- Vulnerability Triage and Remediation: Triage and prioritize vulnerabilities by real risk, work with engineering owners to drive remediation, and track progress against service levels.
- Software Supply Chain: Improve visibility and control of third-party and open-source dependencies, including SBOM generation and accuracy.
- Automation and AI: Develop automation and AI-assisted workflows for triage, code review, and reporting that remove manual work and scale the team.
- Security Testing Partnership: Work with the offensive security team and perform penetration tests and bug bounty reports, and turn findings into fixes and better standards.
- Product Security Incidents: Support the PSIRT process by analyzing reported vulnerabilities, assessing impact, and helping engineering ship and communicate fixes.
- Standards and Enablement: Contribute to secure coding standards, guardrails, and a paved road for engineers, and run training or office hours that make teams more self-sufficient.
- Mentorship and Technical Leadership: Mentor Security Engineers, review their work, and lead workstreams and projects across R&D with limited supervision.
- Agentic AppSec Fleet: Design, build, and run a fleet of AI agents that take on AppSec work at scale, such as triaging scanner findings, validating exploitability, reviewing pull requests and designs for security issues, drafting threat models, proposing fixes, and routing vulnerabilities to the right owners. Define the guardrails, human approval points, evaluation methods, and audit trail that keep agent output accurate, safe, and trusted by engineers, and report the impact on risk and review capacity.
What You’ll Bring
- Experience: 6–9 or more years in cybersecurity, security engineering, or software engineering, including at least 4 years in application or product security.
- Application Security Depth: Strong knowledge of common vulnerability classes, secure design, threat modeling, and authentication and authorization in cloud-native, API-driven applications.
- Software Engineering Skills: Strong programming skills in at least one language such as Python, Go, Java, or TypeScript, and the ability to review other engineers’ code for security issues.
- Security Tooling: Hands-on experience with application security tools, including SAST, SCA, DAST, and secrets scanning, and with integrating them into CI/CD pipelines.
- Cloud and Containers: Working knowledge of at least one major cloud provider and of securing containerized workloads.
- Influence: Track record of working with engineering teams to get security work prioritized and done.
- Mentorship: Track record of developing other engineers.
- Communication: Clear written and verbal communication with engineers, product teams, and senior leaders.
Nice to Have
- AI and Agentic Security: Experience securing LLM-based features and agent systems, including prompt injection and data exposure risks.
- Offensive Security Skills: Experience in penetration testing, vulnerability research, or bug bounty work.
- Software Supply Chain: Experience with SBOM tooling, dependency management, and build integrity.
- Infrastructure and Cloud Posture: Familiarity with Terraform, Kubernetes security, and cloud posture tooling.
- Certifications: OSCP, CSSLP, GIAC, or similar.