Senior Application Security Engineer

About this role

Own application security across Sardine’s financial risk and payments platform, focusing on authorization vulnerabilities and business logic abuse. Build an automated vulnerability-management pipeline and address systemic causes of security issues across a multi-language, multi-cloud environment.

About the company

Sardine is a financial crime platform that helps companies detect fraud, money laundering, and other risk with real-time behavioral and device intelligence.

The team

Application security team within Security and IT.

Stack

What you'll do

• Triage, validate, route, and drive remediation of findings from scanners, code reviews, pentests, and bug bounty.
• Automate vulnerability-management workflows using scanner, ticketing, and source-control APIs.
• Identify recurring vulnerabilities and establish secure patterns, defaults, and custom static-analysis rules.
• Review platform controls including authorization, service identity, secrets handling, and gateway enforcement.
• Perform application and API testing, code reviews, and threat modeling.
• Direct external penetration tests and the bug bounty program.
• Enable engineering teams through security guidance and a security champions program.

What we're looking for

• Experience running and automating vulnerability management end to end.
• Software engineering experience, including shipping and maintaining production software.
• Code-auditing experience in at least one of Go, Python, Node.js, Ruby, or Java.
• Practical OWASP Top 10 knowledge, with depth in broken access control and business logic flaws.
• Experience integrating and tuning SAST, DAST, and SCA in CI/CD.
• Cloud fundamentals in AWS or GCP, plus Docker and Kubernetes knowledge.
• Strong ownership, security judgment, and ability to influence teams asynchronously.

Nice to have

• Experience scaling security tooling across repositories, languages, and build systems.
• Experience writing custom static-analysis rules with Semgrep, CodeQL, or similar tools.
• Fintech, payments, PCI DSS, SOC 2, or customer-audit experience.
• Offensive security experience, such as penetration testing, red teaming, or bug bounty work.
• Certifications such as OSWE, BSCP, CPTS, or CRTO.
• Public security research, tooling, disclosures, or talks.

Benefits

• Cash compensation and equity, with early exercise available for all options, including pre-vested options.
• Flexible paid time off and a year-end break.
• Health, dental, and vision coverage for employees and dependents.
• 4% 401(k) matching.
• MacBook Pro and a one-time home-office setup stipend.
• Monthly meal and social meet-up stipends.
• Annual health and wellness and learning stipends.