Senior Application Security Engineer

• We hire talented, self-motivated individuals with extreme ownership and high growth orientation.

• We value performance and not hours worked. We believe you shouldn't have to miss your family dinner, your kid's school play, friends get-together, or doctor's appointments for the sake of adhering to an arbitrary work schedule.

• We're a remote-first team spread across time zones, so no office to report to - work from wherever helps you do your best work. Just a couple of things to keep in mind: pay is based on where you're located, and you'll need to keep a home base in the country you're hired in. So while we love the "coffee shop today, mountains tomorrow" life, this isn't a passport-optional, work-from-anywhere-on-Earth kind of remote - think flexible within your country, not borderless.

• Remote -

• Triage, validate, route, and drive remediation of findings from every source: SAST, DAST, SCA, code review, pentests, and bug bounty

• Build the automation that removes manual effort from each of those steps

• External pentests and bug bounty program: set scope, direct the testers, judge severity, and close the loop

• Spot the patterns across findings and remove the root cause, not just the instance

• Set the secure patterns and defaults that make the right way the easy way

• Write custom static analysis rules for our own anti-patterns, so a fixed bug class stays fixed

• Review platform-layer controls (authorization, service identity, secrets handling, gateway enforcement), find the gaps, and push the owning teams until they are closed

• Work alongside engineers on fixes that are simple, get adopted, and hold

• Hands-on testing of our applications and APIs, and manual code review of high-exposure services, with depth in authorization and business logic

• Threat modeling on new and high-exposure designs

• Security enablement across engineering, including a security champions program

We care more about the depth of your judgment than your years of experience.

• Code auditing in at least one of Go, Python, Node.js, Ruby, or Java, and the willingness to work in the rest

• Practical command of the OWASP Top 10, with real depth in broken access control and business logic flaws

• SAST, DAST, and SCA in CI/CD, tuned so engineers trust the output. Cloud fundamentals on GCP or AWS. Docker and Kubernetes.

• You separate real findings from theoretical ones.

• You disagree in the open, with evidence, and update when someone brings better evidence.

• Your influence travels asynchronously, across time zones, to people with strong opinions and no reporting line to you.

• Scaling security tooling across many repositories, languages, and build systems

• Prior experience writing custom static analysis rules (Semgrep, CodeQL, or similar)

• Fintech, payments, or other environments under serious third-party security review (PCI DSS, SOC 2, customer audits)

• Fully distributed, asynchronous engineering experience

• Offensive experience in whatever form you found it. Pentesting on web, API, mobile, or cloud is the most directly relevant. Hardware and embedded work, physical security and lock sport, red team engagements, protocol and radio work, and CTF or bug bounty results all count.

• Advanced offensive certifications. OSWE and BSCP are the most relevant; CPTS, CRTO, and similar also count.

• Public work: research, tooling, disclosures, talks

• Generous compensation in cash and equity

• Early exercise for all options, including pre-vested

• Work from anywhere: Remote-first Culture

• Flexible paid time off and Year-end break

• Health insurance, dental, and vision coverage for employees and dependents - US and Canada specific

• 4% matching in 401k / RRSP - US and Canada specific

• MacBook Pro delivered to your door

• One-time stipend to set up a home office - desk, chair, screen, etc.

• Monthly meal stipend

• Monthly social meet-up stipend

• Annual health and wellness stipend

• Annual Learning stipend

Join a fast-growing company with world-class professionals from around the world. If you are seeking a meaningful career, you found the right place, and we would love to hear from you.

To learn more about how we process your personal information and your rights in regards to your personal information as an applicant and Sardine employee, please visit our Applicant and Worker Privacy Notice .