Senior Application Security Engineer

You will embed application security expertise into product work, partnering with developers on design reviews, threat modeling, authentication, authorization, and secure implementation. You will triage code-security findings, secure AI and LLM features, run external testing and vulnerability disclosure programs, and create guardrails that make secure development easier.

Responsibilities

• Partner with product squads on design reviews, per-feature threat modeling, and authentication and authorization decisions
• Secure authentication and authorization surfaces and identify access-control vulnerabilities
• Triage and prioritize findings from SAST, SCA, secrets, IaC, and AI-driven code-review tools
• Drive dependency-vulnerability remediation and fix issues when appropriate
• Secure AI and LLM features against prompt injection, improper tool permissions, PHI leakage, de-identification failures, and model or API egress
• Scope and run web, mobile, and back-office penetration tests and validate fixes
• Operate the vulnerability disclosure program and establish a bug bounty
• Build secure coding guidelines, hardened libraries and patterns, and pre-commit and pull-request checks

Requirements

• 5 to 8+ years of security engineering experience, including 2 to 3 years in application or product security, or software engineering experience with a strong security focus
• Deep knowledge of web and API security, including OAuth 2.0, OIDC, session and token design, multi-tenancy, OWASP Top 10, and OWASP API Top 10
• Ability to identify access-control flaws through code review
• Ability to read and fix production code, primarily Kotlin and Python
• Python automation skills
• Experience with threat modeling, security design reviews, SAST, SCA, secrets scanning, CI, and vulnerability triage
• Ability to work across API design reviews, supply-chain hardening, and incident response
• Professional fluency in French and English

Benefits

• Well-being activities at least three times per week, including yoga, running, Pilates, and HIIT
• Regular off-sites
• Stocked chocolate and nuts