{"id":1858140,"url":"https://alion.io/job/cloudsmith-senior-application-security-engineer","title":"Senior Application Security Engineer","company":{"id":181039,"name":"Cloudsmith","domain":"cloudsmith.com","url":"https://alion.io/company/cloudsmith-2","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Teamtailor","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Belfast, United Kingdom"],"countries":["GB"],"hiring_countries":["GB","IE"],"hiring_countries_total":2,"salary":null,"salary_estimate":{"min_usd":83000,"max_usd":165000,"period":"year","method":"role_seniority_country_cell","sample_n":20},"experience_years_min":5,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon S3","optional":false},{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"CVSS","optional":false},{"name":"Docker","optional":false},{"name":"Go","optional":false},{"name":"GraphQL","optional":false},{"name":"Hugging Face","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"npm","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"Rust","optional":false},{"name":"Sigstore","optional":false},{"name":"SLSA","optional":false},{"name":"SOC 2","optional":false},{"name":"Terraform","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"Zero Trust","optional":false},{"name":"Datadog","optional":true},{"name":"eBPF","optional":true},{"name":"GitHub","optional":true},{"name":"Google Docs","optional":true},{"name":"JavaScript","optional":true},{"name":"Okta","optional":true},{"name":"Semgrep","optional":true},{"name":"Slack","optional":true},{"name":"Snyk","optional":true},{"name":"Trivy","optional":true},{"name":"Wiz","optional":true}],"status":"live","first_seen_at":"2026-05-21T11:07:03Z","employer_posted_date":"2026-05-21","last_verified_at":"2026-10-04T23:48:51Z","board_verified":true,"closed_at":null,"days_open":136,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":136},"description":"TL;DR: We’re looking for a deeply technical Application Security Engineer to embed inside engineering and help secure Cloudsmith 2.0, the operating system for the modern software supply chain. The ideal person is a software engineer at heart who chose to specialize in security. You should be comfortable moving between code, architecture, and security design.\nAbout Cloudsmith\nCloudsmith is building the operating system for the modern software supply chain.\nWe run a global, fully managed, multi-tenant SaaS platform that helps organizations, from startups to the Fortune 500, secure, govern, and distribute software artifacts at scale.\nWorldwide, our customers use Cloudsmith as a critical infrastructure control plane for CI/CD, developer workflows, security controls, compliance, and software distribution, supporting 30+ formats and ecosystems across languages, containers, and operating systems.\nWe recently raised our Series C to accelerate Cloudsmith 2.0: deeper artifact intelligence, stronger policy and provenance, faster package-aware delivery, and infrastructure built for engineering teams, as well as the modern AI-driven software factory.\nBy developers, for developers: we care about craft, architecture, and enterprise scale.\nThe Role\nAs a Senior Application Security Engineer, you’ll report to the Head of Security and embed directly into one of our engineering tribes.\nYou’ll work alongside Engineering Managers, Product Managers, Principal Engineers, and product engineers as part of the tribe’s day-to-day rhythm. Your job is to advocate for security from within the core engineering function, not from the sidelines.\nThat means joining design discussions early, reviewing code and architecture, identifying risks early, and helping the tribe land secure, pragmatic fixes. We are building a model where security engineers are part-IC, part-security specialist.\nYou should be able to contribute directly, but your greater leverage lies in raising the security judgment of the engineers around you, so good security becomes part of how we work.\nKey Responsibilities\nEmbed inside an engineering tribe and participate in planning, design review, code review, incident learning, and delivery conversations.\n\nCollaborate across security, platform, and engineering guilds so security work routes to the right team, at the right time, with the right priority.\n\nThreat-model product and platform changes across APIs, workers, data stores, queues, object storage, CDNs, identity, policy, and tenant boundaries.\n\nReview production code and architecture for authentication, authorization, data access, secrets handling, artifact integrity, signing, auditability, and abuse cases.\n\nBuild and improve security tooling, paved roads, checks, libraries, and automation that make securing Cloudsmith easier for engineers.\n\nTune and operate security controls across SAST, DAST, SCA, secrets scanning, container scanning, IaC scanning, dependency analysis, and runtime signals.\n\nInvestigate, triage, and remediate vulnerabilities identified through internal testing, third-party testing, responsible disclosure, customer reports, and security tooling.\n\nSupport security incidents, red/blue exercises, detection work, and post-incident actions, improvements, and other investigatory/preventative follow-ups.\n\nSupport technical control work for SOC 2, ISO 27001, EU CRA, and related frameworks, working with GRC where security engineering input is needed.\n\nRaise the tribe's security capability by helping engineers understand risks, threat-model their own work, and recognize what good secure design looks like.\n\nRequired Experience, Qualities & Skills\nTechnical Depth\nAround 5+ years of hands-on application security experience, or equivalent experience across software engineering and security, with security as your recent focus.\n\nDeep software engineering craft, with a focus on Python. Familiarity with TypeScript, Go, or Rust is an advantage. Effective use of ownership-driven AI is useful.\n\nDeep web and API security knowledge: OWASP Top 10, business logic flaws, authn/authz design, token handling, REST, GraphQL, and multi-tenant access control.\n\nPractical threat modeling and vulnerability research experience against real applications, APIs, cloud-native systems, and distributed services.\n\nStrong cloud-native security experience, especially across AWS, IAM, KMS, S3, containers, Terraform, CI/CD, secrets handling, logging, and multi-tenant isolation.\n\nSound judgment on vulnerability priority. You understand CVSS, but you care more about exploitability, reachability, tenant impact, and production reality.\n\nAbility to reason through production systems: APIs, queues, caches, databases, workers, CDNs, object storage, edge delivery, telemetry, and failure modes.\n\nClear communication in a remote-first environment. Your threat models, risk write-ups, incident notes, and feedback should be useful to engineers and credible to leadership.\n\nSoftware Supply Chain & Security\nCloudsmith is not just another SaaS product. We are the artifact control plane for our customers’ software supply chains. You should understand, or be excited to go deep on:\nEcosystems such as npm, PyPI, Docker/OCI, Maven, Helm, and Hugging Face.\n\nSoftware supply chain threats such as dependency confusion, typosquatting, malicious packages, maintainer compromise, metadata poisoning, and build-system injection.\n\nArtifact and registry concepts: immutable blobs, mutable metadata, package identity, checksums, upstream proxying, private repos, access control, caching, and promotion.\n\nProvenance and trust mechanisms such as SBOMs, signing, attestations, SLSA, Sigstore, in-toto, trusted publishing, and zero-trust software delivery.\n\nBonus Points\nExperience securing artifact management, package registry, container registry, CI/CD, DevOps, developer tooling, or supply chain security platforms.\n\nExperience with secure runtime environments, sandboxing, workload isolation, policy engines, OPA/Rego, eBPF, or similar control points.\n\nContributions to open-source security tooling or supply chain security projects.\n\nFamiliarity with Datadog, AWS Security Hub, Okta, GitHub Advanced Security, Snyk, Semgrep, Trivy, Wiz, or similar tooling.\n\nUseful, but not required: certs such as OSCP, CSSLP, GPEN, GWAPT, GCSA, or CISSP.\n\nCultural Values We're Looking For\nEngineering-first security: You operate as an engineer first for security problems.\n\nBuilder mindset: You fix code and automate the boring parts to accelerate others.\n\nPractical paranoia: You can think like an attacker without losing sight of practicality.\n\nHigh standards, low ego: You raise the bar without devolving into arguments.\n\nClear thinking: You can turn messy problems into decisions and trade-offs.\n\nOwnership: You care deeply about the security of the product, platform, and company.\n\nImpact & Growth\nThis role helps shape application security for a platform that secures the software supply chain for organizations from startups to the Fortune 500.\nAI is increasing the rate at which software is created, changed, assembled, and shipped. Enterprises need stronger controls, better provenance, clearer trust decisions, and a faster path to delivery.\nCloudsmith is building the critical infrastructure to record, govern, and deliver software artifacts at scale. You’ll help make that infrastructure safer from the inside.\nAs the function grows, you’ll have the opportunity to shape our application security roadmap, define how security engineers embed within tribes, influence secure engineering patterns, mentor future security hires, and represent Cloudsmith externally in the security community.\nBenefits, Location & Work Environment\nYou must be based in Ireland or the United Kingdom and have the right to work independently without requiring sponsorship.\nHeadlines\nA position based in Ireland or the United Kingdom.\n\nA competitive compensation package, including equity.\n\nWith comprehensive health, dental, and vision insurance.\n\nPlus, generous annual leave and flexible working policies to suit your lifestyle.\n\nIncluding a professional development budget for conferences and training.\n\nIn a dynamic, innovative, trust-centric, and supportive work environment.\n\nBelfast HQ, used for working sessions, planning, all-hands, and team events.\n\nOpportunity to help shape a fast-growing company building critical infrastructure.\n\nRegular travel may be required for team meetings, planning, customers, and events.\n\nHealth and Wellness\nWe care about the health and wellness of our people and their families. Sustainable pace matters. We offer generous annual leave, health and wellbeing benefits, and flexible family-friendly working policies.\nPersonal Growth\nYou will have room to grow alongside strong colleagues. We support professional development through budgets for equipment, training, books, conferences, travel, and certifications.\nFacilities\nCloudsmith is headquartered in Belfast, Northern Ireland, with fully equipped office space for working sessions, planning, meetups, and team activities. We rely on Slack, Google Docs, Linear, and other tools to collaborate across locations.\nAbout Equal Opportunity\nCloudsmith is an equal-opportunity employer, proud to nurture a diverse workplace that welcomes applications from individuals of all races, genders, and ethnicities. We do not discriminate based on age, religion, sexual orientation, citizenship status, military service, or health conditions. We will not tolerate discrimination of any kind.","description_format":"text","description_chars":9515,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"phd","optional":false},"security_clearance":false,"languages":[]},"benefits":["Annual leave","Equity","Flexible schedule","Professional development","Vision insurance"],"hiring_locations":[{"name":"United Kingdom","iso":"GB","kind":"country"},{"name":"Ireland","iso":"IE","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Transportation & Logistics","Supply Chain"],"lifecycle":[{"event":"open","at":"2026-10-04T20:25:50Z"}],"visa":[{"country":"GB","licensed_sponsor":true,"evidence":"Licensed UK visa sponsor (Senior or Specialist Worker, Skilled Worker)","filings_12m":null,"filings_prev_12m":null,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"Global Business Mobility: Senior or Specialist Worker; Skilled Worker","cap_exempt":false,"checked_at":"2026-10-03T21:09:13+00:00","sources":["UK Home Office: register of licensed sponsors (workers)"],"filings_for_role_12m":0}],"liveness":{"score":6,"band":"cold","label":"Long shot","p_open":1,"p_active":0.2,"p_room":0.28,"age_days":136,"expected_fill_days":30,"reasons":["conf:1","win:tail","crowd:"],"computed_at":"2026-10-05T01:07:54Z"},"pay":null,"html_url":"https://alion.io/job/cloudsmith-senior-application-security-engineer","json_url":"https://alion.io/job/cloudsmith-senior-application-security-engineer.json","meta":{"generated_at":"2026-10-05T01:07:54Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","usage":{"tier":"crawler","counted_by":"address","units_charged":1,"used_today":1440,"day_limit":5000,"remaining_today":3560,"minute_limit":60,"resets_at":"2026-10-06T00:00:00Z"}}}