Note: The job is a remote job and is open to candidates in USA. BioRender is on a mission to accelerate the world’s ability to learn, discover, and communicate science. They are seeking a Senior Application Security Engineer to contribute directly to the codebase, define security processes, and build developer-friendly security systems while working with AI-powered capabilities.
Responsibilities
- Contribute production-quality code directly to the application (Node.js/React) and infrastructure (Python, Terraform) – you ship fixes and hardening yourself, not just findings for others to action
- Build and maintain security and CI/CD tooling for automation, keeping the secure path the default path
- Act as a security reviewer on RFCs and design documents, and pair with engineers to resolve issues at the source
- Define secure-by-design patterns and drive standards for authentication, authorization, and API security
- Lead threat modeling on new and existing systems and turn those models into shipped controls
- Own and evolve the Secure SDLC and CI/CD security integration (SAST/DAST/SCA/secrets) – tuned for high signal and low noise
- Work AI-natively: use AI coding assistants and agentic tooling to accelerate code review, triage, and tooling development
- Secure AI-integrated product features – reasoning about prompt injection, data leakage, and over-scoped tool, token, and data access
- Automate recurring security work so the team scales through leverage, not headcount
- Perform penetration testing and code reviews (Node.js/React) using OWASP methodology
- Drive identification and remediation of application security vulnerabilities (SAST/DAST/HackerOne)
- Own the bug bounty program end to end – issue evaluation, reproduction, and closing findings by shipping fixes
Skills
- Demonstrable software engineering ability – you read code fluently, write production-quality code that engineers respect, and have contributed to real codebases (Node.js/React; Python a plus)
- Fluency using AI development tools (AI coding assistants, agentic workflows) to get the job done, and a clear-eyed view of the security risks they introduce
- Expertise in web application security and secure-coding best practices, and the ability to review code and application findings
- Experience integrating and maintaining SAST/DAST systems within CI/CD, and with Secure Software Development Life Cycles
- Hands-on experience securing cloud workloads on AWS and comfort with infrastructure-as-code (Terraform or equivalent); familiarity with Cloudflare a plus
- Threat-modeling experience and command of common code and network vulnerability types, their impact, and remediation
- Applied knowledge of cryptography, PKI, and TLS and their practical implementation
- Experience hardening LLM-integrated or AI-powered features in production
- Experience operating a bug bounty program (e.g. HackerOne)
- Contributions to SOC 2 control design and audit readiness from the engineering side
- Relevant certifications (e.g. OSCP, OSWE, AWS Security Specialty) – valued, but not a substitute for engineering ability
Benefits
- We’re remote-first with team members across Canada and the U.S., offering you the flexibility to work from anywhere.
Company Overview
Company H1B Sponsorship