Note: The job is a remote job and is open to candidates in USA. Gemini is a global crypto and Web3 platform founded by Cameron and Tyler Winklevoss in 2014, offering a wide range of crypto products and services. As a Staff Application Security Engineer, you will own the technical strategy to secure critical attack surfaces and partner directly with senior engineering leadership.
Responsibilities
- Own and evolve the Gemini Secure Software Development Lifecycle guardrails as an application security subject matter expert
- Lead architecture reviews, threat modeling, code reviews, and penetration testing for high-risk applications and services
- Design and build AI agents throughout the SDLC for automated threat modeling during design, AI-driven secure code generation and review, and reducing AppSec toil
- Create and deliver hands-on application security training to enable engineers at scale
- Participate in the Application Security on-call rotation and lead post-incident hardening
Skills
- Proven ability to perform design reviews, threat modeling, secure code reviews, and penetration testing with an attacker mindset
- Strong background in application security best practices and familiarity with common vulnerabilities (e.g. SSRF, race conditions, privilege escalations, etc.)
- Deep code review proficiency in Scala, Java, Go or other common languages, plus hands-on experience in at least Python, Go, or similar for building. Comfortable reviewing production services written in other languages
- Experience implementing custom detection and prevention application security controls to eliminate application security issues beyond OWASP Top 10
- Familiarity with highly regulated environments (financial services, fintech, crypto, or equivalent) and ability to understand business objectives, business context, and security risk
- Strong cross-functional communication and collaboration (Security, Engineering, and Product)
- Typically 7-10+ years of experience or equivalent impact in application security, product security, or similar roles
- Experience building AI application security tooling using agents or skills
- Experience with supply chain security, common frameworks (SLSA, OWASP SPVS) and other CI/CD security controls
- Experience with preventing application security vulnerabilities at scale through secure design patterns, automated tooling, or frameworks
- Experience with microservice architectures and cloud-native environments
Benefits
- A discretionary annual bonus
- Long-term incentive in the form of a new hire equity grant
- Comprehensive health plans
- 401K with company matching
- Paid Parental Leave
- Flexible time off
Company Overview
Company H1B Sponsorship