Staff Engineer, Application Security (Remote, US)

Location: Remote within the United States. Candidates must be authorized to work in the United States without current or future employment visa sponsorship.

Base salary: $170,000–$220,000 per year, plus a target annual bonus of 15% of base salary and long-term incentive program eligibility.

Company

hirify.global, formerly Renew Home, manages residential energy through a large virtual power plant, helping customers improve efficiency, savings, comfort, and clean-energy use.

What you will do

• Define and drive security strategy across applications, cloud infrastructure, and AI systems, prioritizing high-impact risks and leading cross-functional initiatives.
• Lead security architecture reviews, threat modeling, code reviews, security testing, and secure-by-default SDLC controls.
• Design security guardrails for LLM applications, AI agents, coding assistants, and MCP/tool integrations, covering identity, permissions, data access, secrets, sandboxing, and human approval.
• Improve security across AWS/GCP, containers, CI/CD, IAM, and the software supply chain through scalable controls and automation.
• Advance vulnerability management and detection, and provide technical leadership during significant security incidents.
• Build security capabilities through tooling, training, security champions, technical guidance, and mentorship while partnering with Engineering, Infrastructure, IT, and Legal.

Requirements

• 7+ years of experience in application, product, cloud, or infrastructure security, including strong hands-on security engineering experience.
• Strong software engineering skills, including reading, writing, and reviewing production code and designing practical security improvements.
• Deep understanding of application and API security, authentication and authorization, cloud security, and modern software development and delivery.
• Experience designing scalable security architecture and secure-by-default controls across applications and cloud infrastructure.
• Understanding of AI and agentic security risks, including prompt injection, insecure tool use, excessive permissions, sensitive-data leakage, MCP, and third-party AI integrations.
• Proficiency with AWS security services such as IAM, WAF, GuardDuty, and AWS Inspector, plus application security tools including CodeQL, Burp Suite, ZAP, and Nuclei.
• Strong understanding of networking, security, and core Internet protocols, including TCP/IP, DNS, SMTP, SSL, and distributed networks.
• Ability to lead complex initiatives across multiple teams, influence technical direction, work independently in ambiguous environments, and translate security risks into practical engineering decisions.
• Strong communication skills.

Nice to have

• Experience with AWS security services, application security tooling, SOC 2, ISO 27001, and AI-assisted security tools.

Culture & Benefits

• Full-time employment with fully remote work and a home-office setup allowance.
• No preset vacation limits, with an emphasis on taking meaningful paid time off, plus parental leave benefits.
• Health and wellness benefits and a 401(k) plan with employer contributions.
• Annual bonus target of 15% of base salary and participation in long-term incentive programs tied to company growth and performance.
• Work environment focused on sustainable working practices, family support, learning, and growth.