YOUR ROLE

As a Senior Application Security Engineer, you will strengthen the security of our applications, identify and remediate vulnerabilities directly in the code, and promote secure development best practices. You will operate and tune application security tooling, embed security into our development pipelines, and help engineers fix issues before they are ever committed while collaborating with development and infrastructure teams to implement solutions and manage projects independently.

WHAT YOU'LL DO

• Identify, triage, and remediate application vulnerabilities directly in the code — writing the fix and shepherding it through review and deployment with the owning team, not just filing tickets.
• Validate and reproduce findings to eliminate false positives, assess real exploitability and business impact, and drive remediation to closure against defined SLAs.
• Operate, tune, and continuously improve application security tooling (SAST, DAST, software composition analysis and dependency scanning, secrets scanning, and container/image scanning), integrating findings into developer workflows.
• Embed security into CI/CD pipelines and Git-based workflows so vulnerabilities are caught automatically — and, wherever possible, fixed — before code reaches production.
• Partner with development teams to define and roll out secure coding standards and pre-commit / pre-merge checks, shifting security left so issues are caught and fixed before code is committed.
• Lead threat modeling for new features and architecture changes, and perform security-focused code reviews for sensitive changes.
• Maintain application security standards (OWASP Top 10 prevention, input validation and output encoding, parameterized queries, secure-by-default design) and enforce secure API practices.
• Strengthen software supply chain and repository security.
• Maintain compliance with industry-standard frameworks and produce evidence for audits (SOC 2, NYDFS, and PCI DSS).
• Coach developers through hands-on enablement and a security champions program, and provide application security expertise during incident response.
• Lead security projects independently, delivering them on time while aligning with business and security goals.
• Other duties and responsibilities as assigned.

Bold Penguin is the premier digital broker for commercial insurance. Their technology expands top-of-funnel demand and increases yield for enterprise partners. Through digital distribution, wholesale capabilities, and AI-driven insights, they transform the lifecycle of both simple and complex risks, from prospecting to placement.

Benefits

• Medical, Dental, and Vision
• Flexible PTO Policy
• 401(k) with a company match
• Employee Assistance Program
• Parental Leave
• Disability and Life Benefits​