Application Security Engineer

Role overview

Join Arcadia’s Information Security team as an Application Security Engineer. In this role, you will own vulnerability management end-to-end, automate security within the CI/CD pipeline, and act as a trusted application-layer security subject matter expert.

Key missions / responsibilities

• Own the end-to-end vulnerability management lifecycle: triage, prioritize, and drive remediation of findings from security tooling.
• Maintain and improve security automation in CI/CD: build, optimize, and extend security tooling integrations to automate security processes.
• Launch and run a Security Champions program: run workshops and office hours to embed security knowledge into development teams.
• Lead application-layer security during incidents: act as the subject matter expert during security incidents.
• Perform threat modeling and communicate risks effectively to engineering.

Requirements

• Strong experience with CI/CD pipelines and the ability to write and maintain pipeline integrations (e.g., GitHub Actions, Jenkins, GitLab CI).
• Hands-on proficiency with at least two of: SAST, DAST, SCA, CSPM (e.g., Snyk, Checkmarx, Semgrep, Wiz).
• 3–5 years of dedicated application security experience in a SaaS or cloud-native environment.
• Experience with container security (Docker, Kubernetes) and API security patterns (REST, GraphQL).
• Ability to communicate technical risk to non-security engineers in a way that drives action.
• Exposure to threat modeling frameworks such as STRIDE or PASTA.

Nice-to-haves

• Relevant security certifications: OSCP, GWAPT, CSSLP.
• Familiarity with cloud-native AWS security services (e.g., GuardDuty, Security Hub, IAM Access Analyzer).
• Experience standing up or maturing a Security Champions program.