SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Cyera is building a security operating model for the age of AI, helping enterprises secure AI adoption through a unified control plane that understands relationships between data, access, and behaviors across humans, systems, and AI models.
You will join as a Senior Application Security Engineer, reporting to the Head of Application Security. You'll be a senior technical leader in the application security program, working directly with R&D teams to embed security into product design, build, and deployment. You'll lead key workstreams and act as the technical authority for application security across the organization.
Key responsibilities include:
• Code and Design Review: Review high-risk code and architectural designs, helping engineers fix issues at the root cause rather than treating findings in isolation.
• Pipeline Security: Build and tune security checks in CI/CD pipelines, including SAST, DAST, dependency scanning, container scanning, and secrets detection, optimizing for accuracy and signal-to-noise ratio.
• Vulnerability Triage and Remediation: Prioritize vulnerabilities by real risk, drive remediation with engineering owners, and track progress against SLAs.
• Software Supply Chain: Improve visibility and control of third-party and open-source dependencies through SBOM generation, accuracy, and dependency management.
• Automation and AI: Develop automation and AI-assisted workflows for triage, code review, and reporting to scale the team and reduce manual work.
• Security Testing Partnership: Collaborate with offensive security teams on penetration testing and bug bounty analysis; translate findings into fixes and improved standards.
• Product Security Incidents: Support PSIRT processes by analyzing reported vulnerabilities, assessing impact, and enabling engineering to ship and communicate fixes.
• Standards and Enablement: Contribute to secure coding standards and guardrails; run training and office hours to make engineering teams more self-sufficient.
• Mentorship and Technical Leadership: Mentor Security Engineers, review their work, and lead cross-R&D projects with limited supervision.
• Agentic AppSec: Design, build, and operate a fleet of AI agents that handle AppSec work at scale—triaging scanner findings, validating exploitability, reviewing PRs and designs, drafting threat models, proposing fixes, and routing vulnerabilities. Define guardrails, human approval points, evaluation methods, and audit trails to ensure agent output is accurate, safe, and trusted by engineers.
Requirements:
• 6–9+ years in cybersecurity, security engineering, or software engineering, with at least 4 years in application or product security.
• Strong knowledge of common vulnerability classes, secure design, threat modeling, and authentication/authorization in cloud-native, API-driven applications.
• Strong programming skills in at least one language (Python, Go, Java, TypeScript) and ability to review code for security issues.
• Hands-on experience with SAST, SCA, DAST, and secrets scanning tools; experience integrating them into CI/CD pipelines.
• Working knowledge of at least one major cloud provider and securing containerized workloads.
• Track record of working with engineering teams to prioritize and complete security work.
• Track record of developing and mentoring other engineers.
• Clear written and verbal communication with engineers, product teams, and senior leaders.
Nice to Have:
• Experience securing LLM-based features and agent systems, including prompt injection and data exposure risks.
• Penetration testing, vulnerability research, or bug bounty experience.
• SBOM tooling, dependency management, and build integrity experience.
• Familiarity with Terraform, Kubernetes security, and cloud posture tooling.
• Certifications such as OSCP, CSSLP, or GIAC.
