[Hiring] Senior Engineer - Application and Platform Security @Juniper Square

Role Description

As a Senior Engineer - Application and Platform Security on our Platform Engineering team, you’ll find and fix vulnerabilities across our applications and cloud infrastructure. Then you’ll build the guardrails, automation, and secure defaults that keep them from coming back. The role spans application code, build and deployment systems, cloud infrastructure, and our AI-powered features. It’s hands-on: you’ll write production-quality code, ship tools engineers want to use, and use AI agents to multiply your own output.

What you will do:

• Application and product security (your focus)
  • Lead security design reviews and threat models for new product features, with depth in authentication, authorization, data isolation, and high-risk financial workflows.
  • Perform manual code review and security testing of web applications and APIs, focusing on authorization and business logic flaws that scanners miss, and drive fixes through to verification.
  • Design secure-by-default libraries, framework-level controls, and custom static analysis rules that eliminate whole classes of vulnerabilities.
  • Triage application findings from automated and manual testing and external assessments, group them by root cause, and write remediation guidance engineers can act on.
  • Threat-model and test AI-powered product features against risks like prompt injection, unsafe tool use, data leakage, and excessive agency. Define secure patterns other teams can reuse.
• Shared across the team
  • Share design review and triage responsibilities across the team.
  • Support our external penetration testing program, from scoping through retest.
  • Partner with teammates on build pipeline and supply-chain security, especially dependency risk in application code.
  • Participate in incident response for application security events.
  • Build security automation and agents that cut review and triage time.

Qualifications

• Experience: 5+ years in application or product security, or in software engineering with a strong security focus.
• Code review: Deep experience finding vulnerabilities through manual review. You find authorization and business logic flaws by reading code, not only by running a scanner.
• Programming: Strong Python, plus working proficiency in JavaScript/TypeScript, enough to review front-end code for client-side issues. You write production-quality code, not just scripts.
• Identity: In-depth knowledge of OAuth 2.0/OIDC, SAML, MFA, session management, and access control models, with hands-on experience implementing them securely.
• Threat modeling: Experience leading threat modeling sessions with engineering teams and turning the output into concrete requirements.
• Security tooling: Experience running and tuning SAST, SCA, and DAST, including writing custom rules.
• Platform awareness: Working knowledge of cloud, container, and CI/CD security, enough to reason about how application design interacts with infrastructure.
• AI security: A working understanding of LLM application risks and the drive to go deep.
• Collaboration: Clear writing and a track record of influencing engineering teams without becoming a bottleneck.

Nice to have

• An offensive web security background, such as bug bounty, web application CVEs, or CTFs. Certifications like OSWE or BSCP are a plus, not a requirement.
• Experience building developer-facing security tooling or libraries.
• Experience building or running a security champions program.
• Familiarity with OWASP ASVS or the OWASP Top 10 for LLM Applications.