Application Security Engineer (Cloud/Kubernetes)

Location: Remote within the United States

Salary: $135,000–$180,000 per year, plus equity

Company

Sardine provides an agentic risk platform that helps banks and fintechs prevent fraud, financial crime, and AI-driven attacks.

What you will do

• Triage, validate, route, and drive remediation of findings from SAST, DAST, SCA, code review, penetration tests, and bug bounty programs.
• Build automation for vulnerability management using scanner, ticketing, and source-control APIs.
• Manage external penetration tests and bug bounty activities, including scope, tester direction, severity assessment, and remediation follow-up.
• Identify recurring vulnerabilities and establish secure defaults, engineering patterns, and custom static analysis rules.
• Review authorization, service identity, secrets handling, and gateway controls across multi-cloud and Kubernetes environments.
• Perform application and API testing, manual code review, threat modeling, and security enablement across engineering.

Requirements

• Experience running vulnerability management end to end and automating it with code.
• Engineering background with the ability to read unfamiliar code, review architecture, and reason about failure modes.
• Code auditing experience in at least one of Go, Python, Node.js, Ruby, or Java, with willingness to work across the rest.
• Strong knowledge of the OWASP Top 10, especially broken access control and business logic flaws.
• Experience with SAST, DAST, and SCA in CI/CD, cloud fundamentals on GCP or AWS, Docker, and Kubernetes.
• Remote work is limited to the United States, with a home base required in the country of hire.

Nice to have

• Experience writing custom static analysis rules with Semgrep, CodeQL, or similar tools.
• Background in fintech, payments, PCI DSS, SOC 2, or customer security audits.
• Offensive security experience, including web, API, mobile, or cloud penetration testing, bug bounty work, CTFs, or red-team engagements.
• OSWE, BSCP, CPTS, CRTO, or similar offensive security certifications.
• Public security research, tooling, disclosures, or talks.

Culture & Benefits

• Remote-first, asynchronous environment with flexible work within the hiring country.
• Performance-focused culture with autonomy and emphasis on ownership through completion.
• Generous cash and equity compensation with early exercise available for options.
• Flexible paid time off, year-end break, and health, dental, and vision coverage.
• Home-office, meal, social meetup, health and wellness, and learning stipends.
• US employees receive 401(k) matching and a MacBook Pro.