[Hiring] Senior Application Security Engineer @Sardine

Role Description

Sardine makes risk and payment decisions for banks and fintechs. Our customers audit us closely, and application security is a large part of what they examine.

Money moves through this platform, so real adversaries study it. Your job is to find what they would find, especially authorization flaws and business logic abuse, and then make the whole class of bug go away.

The application security team is small. The estate is large: Go, Node.js, Python, Ruby, and Java services running on multi-cloud and Kubernetes. That ratio shapes the work. Findings arrive from scanners, code review, testing, threat modeling, pentesters, and bug bounty hunters. You turn that stream into a pipeline that validates, routes, and closes issues with as little manual effort as possible. Then you use what the pipeline tells you to remove root causes: secure defaults, patterns engineers reach for first, and fixes that hold.

Little here is pre-decided. You determine where the risk is and go after it.

The work

• Running and automating the vulnerability pipeline
• Triage, validate, route, and drive remediation of findings from every source: SAST, DAST, SCA, code review, pentests, and bug bounty
• Build the automation that removes manual effort from each of those steps
• External pentests and bug bounty program: set scope, direct the testers, judge severity, and close the loop
• Making bug classes go away
• Spot the patterns across findings and remove the root cause, not just the instance
• Set the secure patterns and defaults that make the right way the easy way
• Write custom static analysis rules for our own anti-patterns, so a fixed bug class stays fixed
• Review platform-layer controls (authorization, service identity, secrets handling, gateway enforcement), find the gaps, and push the owning teams until they are closed
• Work alongside engineers on fixes that are simple, get adopted, and hold
• Hands-on testing of our applications and APIs, and manual code review of high-exposure services, with depth in authorization and business logic
• Threat modeling on new and high-exposure designs
• Security enablement across engineering, including a security champions program

Qualifications

• Experience running vulnerability management end to end, and automating it with code against scanner, ticketing, and source-control APIs
• Engineering background: shipped and maintained real software, read unfamiliar code quickly, reviewed it rigorously, and reasoned about architecture and failure modes
• Ownership to done: take problems all the way through, including fixes that depend on other teams
• Judgment over tenure: depth of judgment is valued more than years of experience
• Code auditing in at least one of Go, Python, Node.js, Ruby, or Java, and willingness to work in the rest
• Practical command of the OWASP Top 10, with real depth in broken access control and business logic flaws
• SAST, DAST, and SCA in CI/CD, tuned so engineers trust the output
• Cloud fundamentals on GCP or AWS, Docker and Kubernetes
• Ability to separate real findings from theoretical ones
• Ability to disagree in the open, with evidence, and update when someone brings better evidence
• Influence travels asynchronously, across time zones, to people with strong opinions and no reporting line to you

Bonus

• Scaling security tooling across many repositories, languages, and build systems
• Prior experience writing custom static analysis rules (Semgrep, CodeQL, or similar)
• Fintech, payments, or other environments under serious third-party security review (PCI DSS, SOC 2, customer audits)
• Fully distributed, asynchronous engineering experience
• Offensive experience in various forms: pentesting on web, API, mobile, or cloud; hardware and embedded work; physical security and lock sport; red team engagements; protocol and radio work; CTF or bug bounty results
• Advanced offensive certifications: OSWE and BSCP are the most relevant; CPTS, CRTO, and similar also count
• Public work: research, tooling, disclosures, talks

Benefits

• Generous compensation in cash and equity
• Early exercise for all options, including pre-vested
• Work from anywhere: Remote-first Culture
• Flexible paid time off and Year-end break
• Health insurance, dental, and vision coverage for employees and dependents - US and Canada specific
• 4% matching in 401k / RRSP - US and Canada specific
• MacBook Pro delivered to your door
• One-time stipend to set up a home office — desk, chair, screen, etc.
• Monthly meal stipend
• Monthly social meet-up stipend
• Annual health and wellness stipend
• Annual Learning stipend