{"id":2399273,"url":"https://alion.io/job/very-good-security-application-security-engineer","title":"Application Security Engineer","company":{"id":687003,"name":"Very Good Security","domain":"verygoodsecurity.com","url":"https://alion.io/company/verygoodsecurity-2","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"B","score":75,"open_postings":5,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-13T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":["United States","Canada"],"countries":["US","CA"],"hiring_countries":["US","CA"],"hiring_countries_total":2,"salary":{"min":175000,"max":230000,"currency":"USD","period":"year","gross":null,"usd_annual":230000},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"CI/CD","optional":false},{"name":"GitHub","optional":false},{"name":"GitLab","optional":false},{"name":"Java","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Python","optional":false},{"name":"Semgrep","optional":false},{"name":"STRIDE","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Tokenization","optional":false},{"name":"Veracode","optional":false},{"name":"AWS","optional":true}],"status":"live","first_seen_at":"2026-10-12T20:26:15Z","employer_posted_date":"2026-10-12","last_verified_at":"2026-10-13T05:25:56Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"About VGS\nVGS is building the trust infrastructure for a new era of commerce. As commerce becomes agentic, payments are increasing dramatically in volume, speed, and complexity, and the companies driving that shift need a foundation they can fully trust.\nThat's where VGS comes in. We're the world's leader in payment tokenization, trusted by the most innovative AI and Fortune 500 companies, merchants, banks, and fintechs to power modern payments and agentic commerce. We store more than 9 billion tokens and process more than 10 billion monthly interactions, touching a third of all e-commerce. That scale isn't incidental. It's why leading companies embed our universal token vault and credential management platform directly into their stack, taming the complexity of payment data so they can move faster.\nCome build the platform that enables modern payments for the world's largest companies. We're helping businesses unlock new possibilities in an industry that never stops moving. And that takes exceptional people.\nAbout the Role\nAs an Application Security Engineer, you will partner directly across Security and Engineering to build a friction-free, developer-centric security program. You will shape our Secure SDLC, automate security guardrails in our CI/CD pipelines, scale our private bug bounty program, and foster a strong culture of security champions across a globally distributed team.\nAutomate Security Controls: Integrate proactive security tooling (SAST, DAST, SCA) directly into CI/CD pipelines (GitHub/GitLab) to catch vulnerabilities before code hits production.\n\nDefine & Drive Secure SDLC: Design, communicate, and maintain developer-friendly SDLC processes, frameworks, and threat modeling practices (e.g., STRIDE).\n\nManage Bug Bounty & Triage: Spearhead our private bug bounty program-tracking spends, triaging reports, and lowering Mean Time to Mitigation (MTTM).\n\nBuild Engineering Capability: Share best practices through secure coding training and cultivate a Security Champions network across Engineering.\n\nLead AppSec Reviews: Conduct threat models and code reviews for Java and Python microservices.\n\nAmplify Security Culture: Partner with external communications to author technical blogs, manage vulnerability disclosures, and showcase VGS’s security engineering.\n\nWhat You Bring\nAppSec Experience: 3-5+ years of dedicated experience in Application Security and/or full stack development, with proven experience .\n\nTechnical Depth: Practical background conducting secure code assessments for Java and Python applications.\n\nTooling & Automation: Deep familiarity integrating SAST/DAST tools (e.g., GitHub Advanced Security, ZAP/BURP, Synopsys/Veracode, Semgrep and similar tools) into modern CI/CD systems.\n\nVulnerability & Program Management: Hands-on experience operating bug bounty programs and setting program metrics/KPIs.\n\nThreat Modeling: Practical experience applying frameworks like STRIDE to complex systems.\n\nCollaborative Mindset: Exceptional communication skills with a track record of building trust across engineering teams.\n\nNice to Have:\nBA/BS degree\n\nA knack for out-of-the-box thinking that thrives in a fast-paced startup environment\n\nPrior experience in cloud-native, high-growth, or pre-IPO fintech startups.\n\nHands-on experience with AWS security controls and cloud infrastructure.\n\nComfortable navigating fully remote, globally distributed work environments.’\n\nWe're looking for passionate professionals who take pride in their craft and want to help grow a team tackling some of the most critical problems in payments. People who thrive here are curious by nature, unafraid of hard problems, and motivated by the chance to build something that matters at scale.\nIf you're driven to make a meaningful impact, work at the leading edge of payment technology, and grow your career alongside a team that values ownership, collaboration, and continuous learning, you'll feel right at home at VGS.","description_format":"text","description_chars":3952,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Continuous learning"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"},{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Commerce","Payment Processing & Gateways"],"lifecycle":[{"event":"open","at":"2026-10-12T23:04:14Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":36,"reasons":["conf:0","win:early"],"computed_at":"2026-10-13T05:45:00Z"},"pay":{"stated_usd_annual":230000,"is_top_pay":true},"html_url":"https://alion.io/job/very-good-security-application-security-engineer","json_url":"https://alion.io/job/very-good-security-application-security-engineer.json","meta":{"generated_at":"2026-10-13T06:20:37Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9915,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":687003},"rest":"https://alion.io/mcp/rest/get_company?id=687003"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fvery-good-security-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fvery-good-security-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fvery-good-security-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/very-good-security-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fvery-good-security-application-security-engineer"}]}