Senior Application Security Engineer

Position Summary:

The Application Security Engineer III will serve as a technical leader dedicated to helping us build an even more secure software ecosystem for our customers. Beyond identifying and mitigating vulnerabilities, you will architect comprehensive defense strategies and embed security into the fabric of our development lifecycle. Your efforts will help drive our application security posture forward, safeguarding sensitive data and ensuring compliance with industry standards while also preserving engineering velocity.

Essential Duties and Responsibilities:

The essential functions include, but are not limited to the following:

o Lead Security Architecture: Design, build, and maintain scalable security systems and infrastructure that align with the organization's evolving business goals.

o Embed Security by Design: Partner with cross-functional teams to integrate security and privacy controls into the product lifecycle, from project inception to final delivery.

o Scale Security Operations: Build automated systems and programs that allow security at EasyPost to scale efficiently in both breadth and depth of coverage.

o Drive DevSecOps Adoption: Champion "shift-left" methodologies, utilizing Infrastructure-as-Code and CI/CD design patterns to move security feedback to the earliest phases of development.

o Product Innovation: Architect and build competitive customer-facing security features that support business growth and appeal to security-conscious markets.

o Intelligent Notifications: maintain high-fidelity alerting/notification infrastructure that delivers timely, relevant, and actionable intelligence to internal staff and customers.

o Enablement & Education: Create self-service documentation, training materials, and knowledge base resources that empower developers to write safer code and increase productivity.

o M&A Integration: Collaborate directly with M&A entities to assess risks, integrate products, and unify diverse environments under our security standards.

Minimum Education & Experience Qualifications:

oBachelor's degree in computer science, management information systems, or related field.

o 5+ years of related experience, master’s degree and 3+ years of related experience, or equivalent related work experience.

oAbility to code proficiently in at least two of the following programming languages: Python, Ruby, Go, and Rust.

oAbility to design systems that are simple to understand, maintainable, scalable, and resilient.

oPrior experience securing large-scale web applications and/or Application Programming Interfaces (APIs), including performing security design reviews, vulnerability assessments, and building testing strategies for logic flaws.

oThe ability to understand and communicate concepts around threat modeling and risk management, including to both technical and non-technical stakeholders.

oProven history of building strong partnerships with Engineering and Product teams to deliver world-class products and features.

oWorking knowledge of several compliance and regulatory frameworks (SOC2, ISO 27001, SOX/ITGC, HIPAA, GDPR, CCPA, etc…)

oExperience in assessing risk and selecting key objectives during the vendor management lifecycle for software, hardware, cloud, and software-as-a-service vendors.

oDeep knowledge of how to build and maintain mixed computing environments (Linux, Windows, Mac OS, and mobile devices).

oPast experience with migrating applications and services to public cloud providers (AWS, GCP, Azure, etc…)

Core Competencies Required:

o Knowledge and Application: Complete knowledge and full understanding of areas of specialization, principles and practices within a professional discipline. Assesses unusual circumstances and uses sophisticated analytical and problem solving techniques to identify causes. Resolves and assesses a wide range of issues in creative ways and suggests variations in approach. This job is a fully qualified, experienced professional, journey-level position.

o Complexity & Problem Solving: Works on problems of diverse scope where analysis of information requires evaluation of identifiable factors. Devises solutions based on limited information and precedent and adapts existing approaches to resolve issues. Uses evaluation, judgment, and interpretation to select the right course of action. Work is done independently and is reviewed at critical points.

o Collaboration & Interaction: Enhances relationships and networks with senior internal/external partners who are not familiar with the subject matter, often requiring persuasion. Adapts style to different audiences and often advises others on difficult matters.