{"id":3794384,"url":"https://alion.io/job/extra-space-storage-sr-application-security-engineer","title":"Sr. Application Security Engineer","company":{"id":1803875,"name":"Extra Space Storage","domain":"extraspace.com","url":"https://alion.io/company/extraspace-com","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Salt Lake City, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"C#","optional":false},{"name":"CI/CD","optional":false},{"name":"GitHub","optional":false},{"name":"JavaScript","optional":false},{"name":"LLM","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"Next.js","optional":false},{"name":"NIST 800-53","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP ASVS","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PCI DSS","optional":false},{"name":"React.js","optional":false},{"name":"SQL","optional":false},{"name":"TeamCity","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"Vercel","optional":false}],"status":"live","first_seen_at":"2026-10-28T00:00:00Z","employer_posted_date":"2026-10-28","last_verified_at":"2026-11-05T18:58:47Z","board_verified":true,"closed_at":null,"days_open":8,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":8},"description":"*** Please note that this is a HYBRID role, requiring this person to work at our Cottonwood Heights office in SLC two days a week. We are not able to provide work sponsorship (i.e. OPT, STEM-OPT or H-1B visa) for this role ***\nAs a Sr. Application Security Engineer at Extra Space, you'll be a trusted security partner embedded in how our engineering teams design, build, and ship software. You'll work across our Product Engineering org alongside principal and staff engineers, the cybersecurity team, and a security champion on every engineering team, building security in from the start. Our applications run on AWS and Vercel. They're built mostly with C# .NET, TypeScript, and React/Next.js, backed by SQL Server and other relational and non-relational databases.\nDuties & Responsibilities\nConduct security architecture and design reviews for new and evolving features, surfacing risk early and recommending practical mitigations.\nPerform threat modeling and manual and automated code reviews, and partner with developers to prioritize and remediate what you find.\nDrive a risk-based approach to application security, helping teams understand vulnerabilities in terms of business impact.\nMature our Secure SDLC, including secure coding standards, security requirements, and automated checks (SAST, DAST, SCA, secrets scanning) in our CI/CD pipelines.\nBuild and maintain security tooling and automation that scales across teams, with a focus on reducing risk rather than adding tools.\nLead and grow the security champions program, training champions so each team has security expertise close at hand.\nServe as the application security subject matter expert for engineering, product, and leadership, and mentor engineers on secure development practices.\nMake sure AI tools and AI-powered features are adopted within acceptable risk limits.\nAlign our applications with SOC 1, SOX, CIS v8, and PCI DSS (SAQ-A, SAQ-P2PE), and support audits with evidence and remediation plans.\nRequirements\n6+ years of combined experience in software engineering, application security, product security, or a closely related field.\nProficiency in most of our primary languages (C# .NET, TypeScript, JavaScript, SQL).\nExperience securing web applications built on modern frameworks and cloud-native architectures, particularly AWS.\nHands-on white-box testing and secure code review experience.\nStrong understanding of SSDLC principles and experience implementing or maturing secure development programs.\nSolid understanding of common vulnerabilities and attack techniques (OWASP Top 10, API security, authentication and authorization flaws).\nExperience integrating security tooling into delivery pipelines (GitHub, TeamCity, or similar).\nFamiliarity with AI security risks and emerging attack surfaces, including agentic systems, MCP, and LLM-powered workflows.\nA risk-focused mindset: you can explain security risk in business terms, weigh it against the business's needs and risk tolerance, and help teams make pragmatic decisions without security theater.\nA proven ability to build trusted relationships with engineering teams and guide behavior without direct authority.\nStrong written and verbal communication, equally comfortable in a design review with engineers and a risk conversation with leadership.\nPreferred Qualifications\nDevelopment experience with Next.js, Vercel, or serverless architectures.\nPractical knowledge of security frameworks and standards such as OWASP ASVS, NIST 800-53, CIS v8, PCI DSS, or SOX.\nHands-on security certifications such as OSCP, BSCP, GWEB, PNPT, or similar.\nExperience running or triaging a bug bounty program.\nBachelor's degree in Computer Science, Information Security, or a related field.\n\nWork Environment & Physical Requirements\nPerforms sedentary work in an office environment with limited lifting (less than 10 pounds) or walking required. Close visual acuity required to perform work at computer terminal. No exposure to adverse environmental conditions. Requires repetitive typing motion, talking, hearing, grasping and feeling.\nDisclaimer\nThe job description outlines the general nature and scope of work employees perform in this role. It's not intended to be an exhaustive list of all duties, responsibilities, or qualifications required for the position. The company reserves the right to modify, revise, or update the job description to meet business needs.\nIf you are a current Extra Space employee, please apply through Jobs Hub in Workday.\nWe are an equal opportunity employerand value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.\nApplications Deadline: Applications will be accepted until the position is filled.","description_format":"text","description_chars":4804,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Real Estate Investment","Warehousing"],"lifecycle":[{"event":"open","at":"2026-11-05T08:28:39Z"}],"visa":[],"liveness":{"score":85,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.845,"p_room":1,"age_days":8,"expected_fill_days":29,"reasons":["conf:0","win:early","comp:brand"],"computed_at":"2026-11-05T19:18:34Z"},"pay":null,"html_url":"https://alion.io/job/extra-space-storage-sr-application-security-engineer","json_url":"https://alion.io/job/extra-space-storage-sr-application-security-engineer.json","meta":{"generated_at":"2026-11-05T19:18:34Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":25950,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-06T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1803875},"rest":"https://alion.io/mcp/rest/get_company?id=1803875"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fextra-space-storage-sr-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fextra-space-storage-sr-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fextra-space-storage-sr-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/extra-space-storage-sr-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fextra-space-storage-sr-application-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3794384}},{"tool":"search_jobs","arguments":{"company":"extraspace.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3794384},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}