SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Sardine is a leading agentic risk platform for fighting financial crime, offering integrated solutions for fraud prevention, compliance, and risk infrastructure. The company serves major clients including FIS, GoDaddy, Intuit, Edward Jones, ZoomInfo, and Checkout.com, leveraging a fraud consortium spanning 6 billion profiled devices, 800 million consumers, and 3 million businesses.
As a Senior Application Security Engineer, you will lead the application security function for a platform that processes financial transactions for banks and fintechs. Your primary responsibilities include:
**Vulnerability Pipeline Management & Automation**: Triage, validate, route, and drive remediation of findings from SAST, DAST, SCA, code review, pentests, and bug bounty programs. Build automation to eliminate manual effort across each step. Manage external pentests and bug bounty programs, including scope-setting, tester direction, severity judgment, and closure.
**Root Cause Elimination**: Identify patterns across findings and remove root causes rather than fixing individual instances. Establish secure patterns and defaults that make secure coding the easy path. Write custom static analysis rules to prevent fixed bug classes from recurring. Review platform-layer controls (authorization, service identity, secrets handling, gateway enforcement) and drive closure of gaps with owning teams.
**Hands-On Security Work**: Conduct manual testing of applications and APIs, perform rigorous code review of high-exposure services with depth in authorization and business logic, and conduct threat modeling on new and high-exposure designs. Provide security enablement across engineering, including leading a security champions program.
The application security team is small relative to a large, multi-language estate (Go, Node.js, Python, Ruby, Java) running on multi-cloud and Kubernetes. You will determine where risk exists and drive solutions with minimal manual overhead. The role requires asynchronous influence across distributed teams with strong opinions and no direct reporting lines to you.
Sardine operates a remote-first culture with flexible work within your country of residence. The company values performance over hours, extreme ownership, and high growth orientation.
**Requirements:**
- End-to-end vulnerability management experience with automation via scanner, ticketing, and source-control APIs
- Proven engineering background: shipped and maintained real software, can read unfamiliar code quickly, review rigorously, and reason about architecture and failure modes
- Ownership mentality: drive problems to completion, including fixes dependent on other teams, and follow up on recommendations across sprints
- Code auditing expertise in at least one of Go, Python, Node.js, Ruby, or Java, with willingness to work across all
- Practical command of OWASP Top 10 with deep expertise in broken access control and business logic flaws
- Hands-on experience with SAST, DAST, and SCA in CI/CD pipelines, tuned for engineer trust
- Cloud fundamentals on GCP or AWS; Docker and Kubernetes proficiency
- Ability to distinguish real findings from theoretical ones
- Strong communication: disagree openly with evidence, update when presented better evidence
- Ability to influence asynchronously across time zones with people who have no reporting line to you
**Bonus Qualifications:**
- Experience scaling security tooling across multiple repositories, languages, and build systems
- Custom static analysis rule writing (Semgrep, CodeQL, or similar)
- Background in fintech, payments, or environments under serious third-party security review (PCI DSS, SOC 2, customer audits)
- Fully distributed, asynchronous engineering experience
- Offensive security experience: pentesting (web, API, mobile, cloud), hardware/embedded, physical security, red team engagements, protocol/radio work, CTF, or bug bounty results
- Advanced offensive certifications (OSWE, BSCP, CPTS, CRTO, or similar)
- Public work: research, tooling, disclosures, talks
