{"id":2470912,"url":"https://alion.io/job/quarter-master-security-engineer-application-security","title":"Security Engineer, Application Security","company":{"id":687720,"name":"Quarter Master","domain":"quartermaster.us","url":"https://alion.io/company/quartermaster","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":142000,"max_usd":253000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":340},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"C++","optional":false},{"name":"CI/CD","optional":false},{"name":"CodeQL","optional":false},{"name":"CWE","optional":false},{"name":"Edge AI","optional":false},{"name":"GCP","optional":false},{"name":"Go","optional":false},{"name":"gRPC","optional":false},{"name":"JavaScript","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"Rust","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"Burp Suite","optional":true},{"name":"Kubernetes","optional":true},{"name":"NIST 800-171","optional":true},{"name":"Sigstore","optional":true},{"name":"SLSA","optional":true},{"name":"Terraform","optional":true}],"status":"live","first_seen_at":"2026-10-13T17:41:51Z","employer_posted_date":"2026-10-13","last_verified_at":"2026-10-16T18:30:48Z","board_verified":true,"closed_at":null,"days_open":3,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":3},"description":"About Quartermaster AI\nAt Quartermaster AI, we believe the ocean should be a safe and sustainably managed resource for all. By leveraging cutting-edge AI and robotics, we unlock capabilities that were only recently impossible. Our distributed open-ocean systems enable every vessel to sense, compute, and communicate, enhancing maritime domain awareness for those who need it most.\nThe software we ship runs in contested environments and on systems our partners stake their missions on. We need an application security engineer who can build security into our products from the first design review to the last line of code - making secure the easy, default path for every engineer on the team.\nThe Role\nAs our Security Engineer, Application Security, you will own the security of the software we build - our cloud services, APIs, data pipelines, and the applications that run across our distributed, edge-deployed systems. You will be the security partner engineering teams turn to: leading threat models and design reviews, finding and helping fix vulnerabilities in code, and steering the architecture of our products toward secure-by-default.\nThis is a hands-on senior role with broad autonomy. You’ll go deep on code and architecture, build the tooling and automation that scales application security across a fast-moving engineering org, and raise the security bar through developer enablement rather than gatekeeping. You will work closely with Engineering, our security operations team, and GRC, and help shape the secure software development lifecycle as the company grows.\nKey Responsibilities\nLead threat modeling and secure design reviews for new and existing services, identifying and mitigating risk early in the development lifecycle.\n\nPerform in-depth secure code reviews and full-scope application security assessments - whitebox, greybox, and blackbox - across web, API, cloud, and backend services.\n\nBuild, integrate, and tune application security tooling in CI/CD - SAST, DAST, SCA, secret scanning, and static analysis platforms such as CodeQL - to catch vulnerabilities before they ship.\n\nTriage, prioritize, and drive remediation of application vulnerabilities together with engineering teams, ranking work by real-world risk and business impact.\n\nDevelop automation and paved-road tooling that eliminate entire classes of weaknesses and make the secure path the default path for developers.\n\nServe as the application security subject-matter expert for engineers and architects, steering product design toward secure-by-default patterns.\n\nDefine and mature the secure software development lifecycle (SDLC), secure coding standards, and security requirements across the engineering organization.\n\nOwn or support the vulnerability disclosure and bug bounty process - scoping, validating submissions, performing root-cause analysis, and coordinating fixes with engineering.\n\nStrengthen software supply chain security, including dependency management, artifact and commit signing, and build/pipeline integrity.\n\nPartner with the security operations team on application-layer incidents, providing code-level expertise during investigation and remediation.\n\nDeliver developer-focused security training and champion a security-aware engineering culture through enablement rather than gatekeeping.\n\nRequired Qualifications\n5-8 years in application security, product security, or software engineering with a strong security focus.\n\nSoftware development experience in one or more modern languages (e.g., Python, Go, Java, JavaScript/TypeScript, Rust, or C/C++) and the ability to read and reason about production code.\n\nDemonstrated experience evaluating code for vulnerabilities and weaknesses, and leading threat modeling and security design reviews.\n\nHands-on experience with application security tooling - SAST, DAST, SCA, and static analysis platforms such as CodeQL - and integrating them into CI/CD pipelines.\n\nStrong understanding of the OWASP Top 10 (web and API), CWE, common vulnerability classes, and secure coding practices.\n\nExperience securing modern architectures - microservices/SOA, REST/gRPC APIs, containers, and cloud environments (AWS, Azure, or GCP).\n\nExperience performing black-box and grey-box testing of web applications and APIs.\n\nProven track record driving vulnerability remediation by partnering with engineering teams rather than blocking them.\n\nExcellent written and verbal communication skills, with the ability to influence engineers and explain risk to both technical and non-technical audiences.\n\nMust be a U.S. citizen.\n\nBachelor’s degree in Computer Science, Cybersecurity, or equivalent hands-on experience.\n\nPreferred Qualifications\nActive U.S. security clearance, or eligibility and willingness to obtain and maintain one.\n\nIndustry certifications such as OSCP, OSWE, GWAPT, GWEB, CSSLP, or Burp Suite Certified Practitioner.\n\nExperience building “paved road” / secure-by-default frameworks and developer self-service security tooling.\n\nExperience with software supply chain security (SLSA, in-toto, Sigstore) and artifact/commit signing.\n\nExperience with infrastructure-as-code and cloud-native security (Terraform, Kubernetes).\n\nContributions to bug bounty programs, published CVEs, security research, or open-source security tooling.\n\nFamiliarity with securing embedded, edge, or robotics/IoT software.\n\nFamiliarity with defense-sector compliance frameworks (NIST 800-171, CMMC) as they relate to secure development.\n\nPrior experience in a startup, defense, intelligence, or critical-infrastructure environment.\n\nWhy Join Quartermaster AI?\nBuild application security from the ground up for a company defending critical maritime and national-security infrastructure.\n\nWork with cutting-edge AI and robotics systems in real-world, high-stakes environments.\n\nSignificant autonomy to shape the secure SDLC, tooling, and standards the entire engineering org builds on.\n\nCompetitive salary with comprehensive medical, dental, and vision benefits.\n\nFlexible remote work with a mission-driven, fast-moving team.\n\nCareer growth in a rapidly scaling defense-tech company at the forefront of maritime AI.","description_format":"text","description_chars":6150,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Computer Vision","Video Surveillance"],"lifecycle":[{"event":"open","at":"2026-10-13T19:48:27Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":2,"expected_fill_days":35,"reasons":["conf:0","velocity","win:early"],"computed_at":"2026-10-16T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/quarter-master-security-engineer-application-security","json_url":"https://alion.io/job/quarter-master-security-engineer-application-security.json","meta":{"generated_at":"2026-10-16T18:42:07Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4032,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-17T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":687720},"rest":"https://alion.io/mcp/rest/get_company?id=687720"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fquarter-master-security-engineer-application-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fquarter-master-security-engineer-application-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fquarter-master-security-engineer-application-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/quarter-master-security-engineer-application-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fquarter-master-security-engineer-application-security"}]}