{"id":27859,"url":"https://alion.io/job/monarch-senior-application-security-engineer","title":"Senior Application Security Engineer","company":{"id":14618,"name":"Monarch","domain":"monarch.com","url":"https://alion.io/company/monarch","size_band":"11-50","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":83,"open_postings":3,"ghost_share":0,"stale_share":0.667,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-16T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":{"label":"PT","utc_offset_min":-8,"utc_offset_max":-8},"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US","CA"],"hiring_countries_total":2,"salary":{"min":180000,"max":215000,"currency":"USD","period":"year","gross":null,"usd_annual":215000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"AI Agents","optional":false},{"name":"Burp Suite","optional":false},{"name":"CI/CD","optional":false},{"name":"Django","optional":false},{"name":"LLM","optional":false},{"name":"Nuclei","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Python","optional":false},{"name":"Semgrep","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Amazon ECS","optional":true},{"name":"Amazon EKS","optional":true},{"name":"AWS","optional":true},{"name":"IAM","optional":true},{"name":"Kubernetes","optional":true},{"name":"NIST CSF","optional":true},{"name":"Red Teaming","optional":true},{"name":"Rest API","optional":true},{"name":"SOC 2","optional":true}],"status":"live","first_seen_at":"2026-07-02T20:13:28Z","employer_posted_date":"2026-07-02","last_verified_at":"2026-10-16T13:44:28Z","board_verified":true,"closed_at":null,"days_open":105,"trust":{"level":"stale","repost_count":0,"flags":["stale"],"days_open":105},"description":"About Us:\nMonarch is a powerful, all-in-one personal finance platform designed to help make the complexity of finances feel simple again. Since launching in 2021, we've become the top-recommended personal finance app by users and experts. Our goal? To take the stress out of finances so our members can focus on what truly matters.\nWe are a team of do-ers led by experienced entrepreneurs who are passionate about helping our members reach their financial goals. We're hyper focused on building a product people love, and on finding every edge that helps us do that better. AI is core to how we operate: every person on the team uses it as a partner to sharpen judgment, move faster, and expand what's possible. We're not looking for tool mastery, we're looking for fluency and curiosity. What matters is that AI is part of how you work today and that you're actively raising your own bar on how to use it well.\nAs a fully remote company (even before COVID!), we welcome applicants from almost anywhere. Our team collaborates synchronously mostly from 9 AM - 2 PM PT and embraces asynchronous work to stay connected across time zones.\nJoin us on our mission to transform lives by simplifying money, together.\nThe Role:\nMonarch is seeking a Senior Application Security Engineer to join our Security Engineering team during a period of rapid growth. Reporting to the Head of Engineering Infrastructure, you will be a hands-on practitioner embedded across our product and engineering teams - conducting application security reviews, executing on vulnerability management, and applying and improving our AppSec and AI security practices as Monarch scales.\nAs a key contributor on the Foundations security team, you'll work directly with product engineers to identify and close security gaps, perform and improve SAST/DAST operations, and apply AI security review processes across Monarch's growing LLM-integrated and agentic product surface. This role is critical in ensuring our application layer remains secure and resilient as we handle increasingly sensitive financial data for over a million users.\nWhat You'll Do:\nConduct application security reviews - threat modeling, code review, and risk assessment - for new features and major product changes across Monarch's Django/Python stack\n\nPerform and improve SAST/DAST operations including triage, validation, and remediation tracking of findings in CI/CD pipelines\n\nWork through the vulnerability backlog with urgency - maintaining triage criteria, remediation tracking, and escalation paths in partnership with engineering squads\n\nPerform and coordinate penetration testing and security assessments against Monarch's web and API surfaces\n\nApply and improve AI security review processes for LLM-integrated features and agentic attack surfaces - covering prompt injection, data leakage, model abuse, and supply chain risk\n\nBuild and maintain security automations and AI-powered tooling, and define and assess security requirements for AI workflows and agentic systems.\n\nParticipate in the weekly security on-call rotation\n\nWhat You'll Bring:\n5+ years in security engineering with demonstrated depth in Application and AI security - threat modeling, SAST/DAST, secure code review, and vulnerability management\n\nProficiency in Python and strong understanding of web application security (OWASP Top 10, API security, auth/authz patterns)\n\nHands-on experience with application security tooling - Semgrep, Burp Suite, Nuclei, or equivalents\n\nFamiliarity with AI/ML security risks - prompt injection, model abuse, agentic attack surfaces, or LLM supply chain risk\n\nTransformative AI fluency - actively uses AI tools to accelerate security work and build automation\n\nNice to Haves:\nExperience in fintech or with financial data security requirements\n\nFamiliarity with SOC 2, NIST CSF, or similar compliance frameworks\n\nCloud security experience (AWS preferred) - IAM, container security, ECS/EKS\n\nRelevant certifications: OSCP, BSCP, CSSLP, CISSP, or equivalent\n\nDetection engineering and incident response experience\n\nAdditional offensive security experience - red teaming, bug bounty, or broader penetration testing beyond web/API surfaces\n\nTypical Process:\nRecruiter Video Call\n\nHiring Manager Video Call\n\nTake Home Assignment\n\nVirtual \"Onsite\" Round (2-4 interviews)\n\nReference Checks\n\nOffer!\n\nBenefits :\nWork wherever you want! As a fully remote company with no central office, we want you to work wherever you are happiest and most productive. Whether that’s out of your home, a co-working space, or elsewhere.\n\nCompetitive cash and equity compensation in a hyper growth, early stage company .\n\nStipend to set-up your ideal working environment.\n\nCompetitive Benefit Plans for employees based on your location (e.g. in the US we offer: Medical, dental and vision benefits and the ability to contribute to a 401k plan).\n\nUnlimited PTO.\n\n3 day weekend every month! We take off the “First Friday” every month to focus on rest, recuperation, or just having fun!\n\nEqual Opportunity & Non-Discrimination\nWe are an equal opportunity employer and value diversity. We do not discriminate on the basis of race, religion, color, national origin, sex (including pregnancy and gender identity), sexual orientation, age, marital status, veteran status, disability status, or genetic information.\nApplicant Notices\nCalifornia & San Francisco: Pursuant to the California Fair Chance Act and the San Francisco Fair Chance Ordinance, qualified applicants with arrest and conviction records will be considered for employment. We comply with all applicable fair chance hiring laws.","description_format":"text","description_chars":5607,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["401k plan","Equity","Unlimited PTO"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"},{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Personal Finance Apps & Education"],"lifecycle":[{"event":"open","at":"2026-07-02T20:13:28Z"}],"visa":[],"liveness":{"score":4,"band":"cold","label":"Long shot","p_open":1,"p_active":0.154,"p_room":0.28,"age_days":105,"expected_fill_days":7,"reasons":["conf:1","win:tail","crowd:"],"computed_at":"2026-10-16T05:45:00Z"},"pay":{"stated_usd_annual":215000,"is_top_pay":true},"html_url":"https://alion.io/job/monarch-senior-application-security-engineer","json_url":"https://alion.io/job/monarch-senior-application-security-engineer.json","meta":{"generated_at":"2026-10-16T17:42:57Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2443,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-17T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":14618},"rest":"https://alion.io/mcp/rest/get_company?id=14618"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fmonarch-senior-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fmonarch-senior-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fmonarch-senior-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/monarch-senior-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fmonarch-senior-application-security-engineer"}]}