Senior Staff Backend AppSec Engineer

Role Overview

Join SentinelOne as a Senior Staff Backend AppSec Engineer. You will serve as a trusted advisor for Python and Node.js application security, leading customer engagements, validating security findings, and mentoring engineers while raising the technical bar for the practice.

Key Missions

• Lead customer engagements for Wayfinder Frontier AI Services, delivering technical findings and presenting results to stakeholders.
• Review and triage code scanning pipeline findings, validating true positives and ensuring customer-ready, actionable outputs.
• Mentor senior-level AppSec engineers and help shape the service line’s methodology and engagement playbooks.

Responsibilities

• Conduct deep code reviews and present findings to stakeholders.
• Author and maintain SAST rule packs and custom static-analysis rules/queries for modern SAST engines.
• Provide expert remediation guidance based on validated findings.
• Support validation of findings produced by automated and agentic analysis pipelines (including AI-assisted code review workflows).
• Translate complex security findings into technical and executive-level debriefs.

Requirements

• 7+ years in application security or product security with strong software development background.
• Strong knowledge of application security fundamentals and modern authentication:
  • OWASP Top 10, CWE Top 25
  • SAML, OAuth, OIDC, JWT internals
• Working knowledge of Python and JavaScript packaging/dependency resolution:
  • Python: pip/Poetry/uv
  • JS: npm/pnpm/yarn
  • Familiarity with supply-chain failure modes
• Expertise in Node.js/TypeScript (e.g., Express, NestJS).
• Expertise in Python backend stacks (e.g., Django, Flask, FastAPI).
• Fluency with Git and CI/CD security controls (runner hardening, build-pipeline security, release-gate enforcement).
• Experience delivering customer-facing/consulting-style engagements end-to-end in a distributed remote environment.

Nice to Have

• Working knowledge of front-end frameworks (React, Next.js, or Angular) and how auth/CSRF/data flows between client and API.
• Experience with AI-accelerated development / code scanning methodologies.