Senior Application Security Engineer

Senior Application Security Engineer

Unqork empowers enterprises to accelerate growth by rapidly building, testing, and running applications that are designed to be AI-native. Trusted by the world’s largest organizations in highly regulated industries, these applications become more secure over time while significantly reducing technical debt—allowing businesses to focus on innovation rather than maintenance. Unqork’s customers include Goldman Sachs, Marsh, BlackRock, and the U.S. Department of Health and Human Services.

At Unqork, we value inclusive and innovative thinkers who boldly challenge the status quo. We encourage you to apply!

Role Overview

You will be part of a team that is passionate about securing Unqork's Commercial and FedRAMP technology stack. You will champion application security best practices and drive their adoption across Unqork's engineering organizations. You will automate processes using policy as code. You'll leverage your deep technical expertise to oversee the identification and remediation of security vulnerabilities and misconfigurations. In this role, you will be responsible for identifying vulnerabilities, providing remediation guidance, and fostering a culture of Security by Design.

This is a technical, hands-on role requiring a mix of manual penetration testing, automated tool management, and deep code-level analysis. You will work side-by-side with our engineering teams to ensure our application and infrastructure remain resilient against modern threats.

The Impact You Will Make

• Vulnerability Management: Perform deep-dive manual penetration testing and security assessments on web applications to identify flaws beyond the reach of automated tools.
• Tool Orchestration: Triage and manage results from SAST (Static), DAST (Dynamic), and SCA (Software Composition Analysis) tools, reducing false positives and prioritizing critical risks.
• Code Review: Conduct thorough security code reviews of Node.js applications to identify logic flaws, injection vulnerabilities, and broken access controls.
• Automation: Develop Python scripts to automate repetitive security tasks, integrate security checks into CI/CD pipelines, and enhance our internal security tooling.
• Remediation & Partnership: Act as a security consultant for developers, tracking vulnerabilities from discovery through to successful remediation and verification.
• Standardization: Stay current with the OWASP Top 10 and other industry frameworks to ensure