Note: The job is a remote job and is open to candidates in USA. nineDots.io is a remote-first software company that builds software used by people working across science and research. The Senior Application Security Engineer will write production code to fix vulnerabilities, build security automation, define secure application patterns, lead threat modeling, and secure AI-powered features across Node.js, React, Python, Terraform, AWS, and Cloudflare infrastructure.
Responsibilities
- Writing production code to fix vulnerabilities and harden the application and infrastructure
- Building security tooling and automation into CI/CD, making the secure route the easiest route
- Reviewing RFCs and technical designs before problems become considerably more annoying
- Defining secure patterns for authentication, authorization and API security
- Leading threat modelling and turning the results into practical controls
- Improving SAST, DAST, software composition analysis and secrets detection, with an emphasis on useful signals rather than burying engineers in alerts
- Testing web applications and reviewing Node.js and React code using OWASP methodology
- Running the bug bounty programme, from validating reports through to shipping fixes
- Securing AI-powered product features against prompt injection, data leakage and overly broad access to tools, tokens or data
- Using AI coding tools and agentic workflows in your own work, sensibly and with your eyes open
Skills
- Strong application and web security experience
- Production software engineering experience, ideally with Node.js and React
- The ability to read, review and write code that other engineers respect
- Experience integrating and maintaining SAST and DAST tooling within CI/CD
- Hands-on AWS security experience
- Infrastructure-as-code experience, ideally Terraform
- A practical understanding of common application and network vulnerabilities, including how to remediate them
- Applied knowledge of cryptography, PKI and TLS
- Experience using AI development tools, plus a realistic understanding of the security problems they can introduce
- Python and Cloudflare experience would be useful
- Experience securing AI or experience securing AI or LLM-powered features, running a bug bounty programme or contributing to SOC 2 controls would also be helpful
Benefits
- Remote-first work arrangement
Company Overview