Note: The job is a remote job and is open to candidates in USA. SentinelOne is an AI-native cybersecurity company that provides autonomous protection across endpoint, cloud, identity, data, and AI systems. The Senior Application Security Engineer will support customer engagements, review and validate agentic code-scanning findings, conduct deep source-code assessments, present technical risks, develop SAST rules, and provide remediation guidance.
Responsibilities
- Support Wayfinder Frontier AI Services customer engagements end-to-end, scope the work, deliver the technical findings, and present results to executive and technical stakeholders
- Review and triage findings from our agentic code scanning pipeline against customer C, C++, Rust, and Java codebases; validate true positives, eliminate noise, and ensure every finding that reaches the customer is a decision they can act on
- Conduct deep code review across C, C++, Rust, and Java code and common frameworks
- Present findings to stakeholders, translate technical risk into business impact, and map exposures into end-to-end exploitation chains
- Author and maintain SAST rule packs that scale across the customer base, and partner with our AI/ML engineers to improve our agentic scanning engine
- Provide expert remediation guidance to customer development teams and validate fixes through follow-up review
- Work closely with our engineering teams to enhance our agentic code scanning pipeline and reduce false positives
- Collaborate with team members and software-focused threat hunters to elevate team technical standards
Skills
- 5+ years in application security or product security with a strong software development background
- A proven track record translating complex findings into technical and executive-level debriefs; excellent written and verbal communication is essential
- Experience delivering customer-facing or consulting-style engagements end-to-end, comfortable in a distributed remote organization
- Proficiency in at least two of C, C++, Rust, and Java, having previously identified and explained vulnerabilities at the framework level, not just the application level
- Proficiency in at least two of C, C++, Rust, and Java, with a strong understanding of vulnerabilities and secure coding methodologies
- Strong knowledge of OWASP Top 10, CWE Top 25, and modern authentication infrastructure (SAML, OAuth, OIDC, JWT internals); experience driving an application through ASVS Level 4 verification is a plus
- Hands-on experience authoring custom static-analysis rules and queries for modern SAST engines; familiarity with AI-assisted code review workflows and validating findings produced by automated and agentic analysis pipelines
- Strong threat modeling experience throughout the secure SDLC
- Fluency with Git-based source control and CI/CD pipelines, including build-pipeline security controls, runner hardening, and release-gate enforcement
- Experience with AI-accelerated development or code scanning methodologies
- Working depth in Python (Django/Flask) and Node.js (Express) for cross-language reviews
- Reverse engineering of compiled C, C++, Rust, Java (IDA Pro, Binary Ninja, Ghidra)
- OSWE, CSSLP, GWAPT, published CVEs, or conference talks
- Familiarity with SOC 2, ISO 27001, or FedRAMP control mapping
Benefits
- Restricted Stock Units (RSUs)
- Employee Stock Purchase Plan (ESPP)
- Flexible time off
- Paid company holidays and paid sick time
- Gender-neutral parental leave
- Grandparent leave
- Medical, dental, and vision coverage
- 401(k) retirement plan with company match
- Life and disability insurance
- Health and dependent care FSA
- Voluntary benefits (hospital, accident, critical illness)
- Employee Assistance Program (EAP)
- ARAG pre-paid legal
- Nationwide pet insurance
- Cancer Care program
- Global business travel medical insurance
- Home office allowance
- Mobile phone reimbursement
- Wellness coach
- Wellness/gym reimbursement
- Fertility coverage
- Adoption & surrogacy reimbursement
Company Overview
Company H1B Sponsorship