[Remote] Sr. Application Security Engineer
Note: The job is a remote job and is open to candidates in USA. Mitek Systems is a global leader in digital and biometric identity authentication solutions. They are seeking a Senior Application Security Engineer to be the technical authority on the security of their software products, focusing on vulnerability remediation and embedding security into the software development lifecycle.
Responsibilities
- Own the application vulnerability remediation program with prioritized developer guidance and clear SLAs
- Work with development squads to explain findings, validate fixes, and confirm remediation
- Drive systemic root-cause fixes rather than one-by-one patching; escalate unresolved criticals and highs
- Define and own the SDLC — security gates and review checkpoints in sprint and release processes
- Ensure SAST, DAST, and SCA tooling is configured, tuned, and producing actionable developer output
- Embed security requirements into product planning and architecture decisions
- Threat-model new features and architectural changes before code is written
- Review designs for authentication, authorization, data-flow, and cryptographic risk
- Produce written threat models that serve as developer guidance and audit evidence
- Own API security standards — OAuth 2.0, mTLS, rate limiting, and abuse prevention
- Conduct or coordinate manual secure code review of security-sensitive components
- Lead application penetration-testing cycles — scoping, managing testers, validating findings
- Build and run a Security Champions program across development squads
- Deliver developer security training on OWASP Top 10 and secure-coding patterns
- Create runbooks, coding standards, and pattern libraries developers can apply independently
Skills
- Knowledge, skills and abilities typically gained through 5–8 years in application/product security or security-focused software engineering
- Application penetration testing including business-logic and API testing
- Hands-on SAST, DAST, and SCA tuning and operationalization
- Secure code review across at least two web-application languages
- Threat modeling using STRIDE, PASTA, or equivalent
- Depth in OWASP Top 10 and API security risks; ability to influence development teams
- Financial services, fintech, or SaaS for regulated industries
- Financial-sector threat knowledge — fraud, account takeover, API abuse
- Cloud-native application security including container security
- PCI-DSS application security requirements
- OSCP, GWEB, or CSSLP
- Prior experience building a Security Champions program
Benefits
- Wellness: Universal, supplemental, and private healthcare plan choices based on country specifics
- Financial future: retirement/pension plan contributions, MTK stock plan participation
- Income protection: life event & disability coverage
- Paid time off: generous annual leave, company holidays, volunteer time off
- Learning: e-learning license, tuition reimbursement, hackathons
- Home office setup allowance
- Additional/optional benefits: pet insurance, identity theft protection, legal assistance
Company Overview
Company H1B Sponsorship