Application Security Engineer III (AI)

Location: United States (Remote); primarily performed from a home office or other approved remote work environment. Occasional travel of up to 10% may be required.

Salary: $106,800–$133,500 annually, plus eligibility for an annual discretionary bonus.

Company

hirify.global operates a B2B e-commerce marketplace for surplus assets, supporting corporate and government sellers and qualified buyers worldwide.

What you will do

• Establish and enforce application security standards, secure design reviews, security gates, release approvals, exception handling, and remediation tracking.
• Perform penetration testing, vulnerability scanning, manual and automated secure code reviews, threat modeling, and architecture reviews across applications and cloud environments.
• Collaborate with development teams on OWASP-aligned secure coding, vulnerability remediation, API security, identity and access controls, and incident response.
• Configure and manage WAFs, CI/CD security pipelines, automated scanning, secrets detection, software composition analysis, SBOMs, artifact signing, and dependency security.
• Secure AI-assisted development workflows, review AI-generated code, protect sensitive information, and assess AI-related security risks.
• Support data protection, privacy by design, PCI DSS scope assessment, payment security, application logging, forensic readiness, and post-incident corrective actions.

Requirements

• 5+ years of experience in application security, secure software development, penetration testing, or DevSecOps security.
• Experience influencing engineering teams and driving remediation across multiple development teams; strong communication, teamwork, and critical-thinking skills.
• Deep knowledge of AWS, Azure, or GCP security, plus DNS, HTTP, cookies, sessions, TLS, browser security controls, threat modeling, secure code reviews, and SSDLC.
• Knowledge of Git, Docker or Kubernetes, automated testing integration, container image security, approved base images, and vulnerability scanning in CI/CD.
• Knowledge of pipeline permissions, build secrets, branch protection, deployment approvals, artifact integrity, code signing, secrets managers, and automated secrets scanning.
• Experience with AI-assisted development tools and the ability to critically review, validate, and test AI-generated code, including its security, privacy, and intellectual property implications.
• Knowledge of REST and GraphQL API security, including OWASP API Security Top 10 risks, API gateways, OAuth 2.0, and API key rotation.
• Experience securing Infrastructure as Code across AWS and Azure using Terraform, CloudFormation, ARM/Bicep, or similar templates, and preventing hardcoded credentials.
• Strong ability to read, review, and write JavaScript/TypeScript, C#/.NET, Java, Python, PowerShell, SQL, AJAX, Angular, and React code.
• Experience with SAST, DAST, SCA, dependency management, and secret-scanning tools such as GitHub Dependabot, GitHub Advanced Security, SonarQube, OWASP Dependency-Check, Claude Security, or Copilot Security.

Nice to have

• CISSP, CSSLP, CASE, OSCP, or OSWE certification.

Culture & Benefits

• Remote work from a safe, secure, distraction-free workspace with reliable internet access.
• Healthcare including medical, dental, vision, prescription drugs, and FSAs.
• 401(k), paid time off, holidays, paid parental leave, life and disability insurance, and an Employee Assistance Program.
• Professional development and tuition assistance.
• Fast-paced agile collaboration with developers and stakeholders.