[Remote] Sr. Application Security Engineer

Note: The job is a remote job and is open to candidates in USA. Mitek Systems is a global leader in digital and biometric identity authentication, fraud prevention, and mobile deposit solutions. The Sr. Application Security Engineer will serve as the technical authority on application security, managing vulnerability remediation, and embedding security into the software development lifecycle while collaborating with development teams to ensure secure coding practices.

Responsibilities

• Own the application vulnerability remediation program with prioritized developer guidance and clear SLAs
• Work with development squads to explain findings, validate fixes, and confirm remediation
• Drive systemic root-cause fixes rather than one-by-one patching; escalate unresolved criticals and highs
• Define and own the SDLC — security gates and review checkpoints in sprint and release processes
• Ensure SAST, DAST, and SCA tooling is configured, tuned, and producing actionable developer output
• Embed security requirements into product planning and architecture decisions
• Threat-model new features and architectural changes before code is written
• Review designs for authentication, authorization, data-flow, and cryptographic risk
• Produce written threat models that serve as developer guidance and audit evidence
• Own API security standards — OAuth 2.0, mTLS, rate limiting, and abuse prevention
• Conduct or coordinate manual secure code review of security-sensitive components
• Lead application penetration-testing cycles — scoping, managing testers, validating findings
• Build and run a Security Champions program across development squads
• Deliver developer security training on OWASP Top 10 and secure-coding patterns
• Create runbooks, coding standards, and pattern libraries developers can apply independently

Skills

• Knowledge, skills and abilities typically gained through 5-8 years in application/product security or security-focused software engineering
• Application penetration testing including business-logic and API testing
• Hands-on SAST, DAST, and SCA tuning and operationalization
• Secure code review across at least two web-application languages
• Threat modeling using STRIDE, PASTA, or equivalent
• Depth in OWASP Top 10 and API security risks; ability to influence development teams
• Financial services, fintech, or SaaS for regulated industries
• Financial-sector threat knowledge — fraud, account takeover, API abuse
• Cloud-native application security including container security
• PCI-DSS application security requirements
• OSCP, GWEB, or CSSLP
• Prior experience building a Security Champions program

Benefits

• Wellness : Universal, supplemental, and private healthcare plan choices based on country specifics
• Retirement/pension plan contributions
• MTK stock plan participation
• Life event & disability coverage
• Generous annual leave
• Company holidays
• Volunteer time off
• E-learning license
• Tuition reimbursement
• Hackathons
• Home office setup allowance
• Pet insurance
• Identity theft protection
• Legal assistance

Company Overview

Company H1B Sponsorship