[Remote] Senior Security Engineer - Application & Product Security at CaptivateIQ

Candidates should have 7+ years of experience in a security engineer or related role, with at least 4 years specializing in web application, API, and product security. Deep expertise in securing multi-tenant SaaS platforms and features is required, along with strong communication skills and the ability to influence software engineers and product managers. Advanced experience in penetration testing, code reviews, and vulnerability assessments is necessary, as is expert knowledge of OWASP Top 10, web application and API security, and common vulnerability classes with practical remediation strategies. Hands-on experience with AppSec tooling (SAST, DAST, SCA) integrated into CI/CD pipelines, strong programming and scripting skills (Python preferred), and the ability to influence secure coding practices are essential. Proven ability to lead incident response for application-layer security events, familiarity with compliance frameworks (SOC 2, ISO 27001), secure SDLC practices, and knowledge of privacy-by-design principles and data security in SaaS environments are also required. Awareness of emerging AI/ML security risks is a plus.