Senior Application Security Engineer (Python)

Location: Remote first; must be based in Ireland or the United Kingdom and have the right to work independently without requiring sponsorship. Belfast HQ is used for working sessions, planning, all-hands, and team events; regular travel may be required.

Company

hirify.global is building a global, fully managed, multi-tenant SaaS platform that secures, governs, and distributes software artifacts across 30+ formats and ecosystems for organizations from startups to the Fortune 500.

What you will do

• Embed in an engineering tribe and participate in planning, architecture and code reviews, incident learning, and delivery discussions.
• Threat-model product and platform changes across APIs, workers, data stores, queues, object storage, CDNs, identity, policy, and tenant boundaries.
• Review production code and architecture for authentication, authorization, data access, secrets, artifact integrity, signing, auditability, and abuse cases.
• Build security tooling, paved roads, libraries, checks, and automation, and operate SAST, DAST, SCA, secrets, container, IaC, dependency, and runtime controls.
• Investigate, triage, and remediate vulnerabilities; support security incidents, red/blue exercises, detection work, and post-incident improvements.
• Support SOC 2, ISO 27001, EU CRA, and related control work while raising secure engineering capability within the tribe.

Requirements

• Around 5+ years of hands-on application security experience, or equivalent software engineering and security experience with security as the recent focus.
• Deep software engineering craft with a focus on Python.
• Deep web and API security knowledge, including OWASP Top 10, business logic flaws, authentication and authorization design, token handling, REST, GraphQL, and multi-tenant access control.
• Practical threat-modeling and vulnerability research experience against real applications, APIs, cloud-native systems, and distributed services.
• Strong cloud-native security experience across AWS, IAM, KMS, S3, containers, Terraform, CI/CD, secrets handling, logging, and multi-tenant isolation.
• Ability to prioritize vulnerabilities using exploitability, reachability, tenant impact, production reality, and CVSS.
• Ability to reason through APIs, queues, caches, databases, workers, CDNs, object storage, edge delivery, telemetry, and failure modes.
• Clear communication in a remote-first environment through threat models, risk write-ups, incident notes, and actionable feedback.
• Understanding of software supply chain ecosystems and threats, including npm, PyPI, Docker/OCI, Maven, Helm, Hugging Face, dependency confusion, typosquatting, malicious packages, maintainer compromise, metadata poisoning, and build-system injection.
• Understanding of artifact and registry concepts, provenance, SBOMs, signing, attestations, SLSA, Sigstore, in-toto, trusted publishing, and zero-trust software delivery.

Nice to have

• Familiarity with TypeScript, Go, or Rust, and effective use of ownership-driven AI.
• Experience securing artifact, package, or container registries, CI/CD, DevOps, developer tooling, or supply chain security platforms.
• Experience with secure runtime environments, sandboxing, workload isolation, policy engines, OPA/Rego, eBPF, or similar control points.
• Contributions to open-source security tooling or supply chain security projects.
• Familiarity with Datadog, AWS Security Hub, Okta, GitHub Advanced Security, Snyk, Semgrep, Trivy, Wiz, or similar tools.
• Certifications such as OSCP, CSSLP, GPEN, GWAPT, GCSA, or CISSP.

Culture & Benefits

• Engineering-first security, builder mindset, practical paranoia, high standards with low ego, clear thinking, and ownership.
• Remote-first working with flexible policies and a Belfast HQ for working sessions, planning, all-hands, and team activities.
• Comprehensive health, dental, and vision insurance, health and wellbeing benefits, generous annual leave, and family-friendly policies.
• Professional development support for equipment, training, books, conferences, travel, and certifications.
• Competitive compensation including equity; regular travel may be required for team meetings, planning, customers, and events.

Hiring process

• Every application is read by a real person; there is no automated sift or keyword filtering.
• The full selection process, including each stage, participants, and preparation guidance, is provided upfront.