Application Security Engineer (Go/TypeScript)

Location: San Francisco, United States; hybrid

Company

hirify.global builds identity governance and intelligent access management for enterprise environments in the AI era.

What you will do

• Own the secure software development lifecycle, including threat modeling, design reviews, code reviews, and security standards.
• Coordinate internal and external application penetration tests and drive findings through remediation.
• Build and maintain SAST, DAST, and SCA tooling integrated into CI/CD pipelines.
• Develop security-critical production code in Go and TypeScript, including encryption services, authorization enforcement, authentication flows, and shared security libraries.
• Investigate and contain security incidents, identify root causes, and improve detection, logging, and alerting.
• Partner with Infrastructure Engineering on AWS and Kubernetes cloud security and mentor engineers on secure coding and security architecture.

Requirements

• 4+ years of experience in application security or software security engineering.
• Production software development experience, not only security assessment and reporting.
• Strong knowledge of OAuth 2.0, OIDC, SAML, session management, and token lifecycle security.
• Experience with AWS and containerized environments, including Kubernetes and Docker.
• Experience leading complex cross-functional security initiatives from kickoff through completion.
• Experience conducting or participating in external penetration tests and overseeing remediation.

Nice to have

• Familiarity with Go, TypeScript, React, PostgreSQL, Redis, and GraphQL.

Culture & Benefits

• Work directly with engineering as an embedded security partner.
• Take ownership of the security roadmap and application security standards.
• Collaborate with engineers to make secure development practices practical and accessible.