Lead Application Security Engineer

Salary: $200,000 - 260,000 per year Requirements: At least 6 years of experience with application security processes and at least 2 years leading or managing an application security team. Broad application security expertise, with deep foundational knowledge in key areas, and the ability to quickly learn unfamiliar languages, frameworks, and architectures. Professional experience using AI systems and agents to achieve security outcomes. Strong understanding of the OWASP Top 10, CWE Top 25, and secure design patterns. Hands-on experience with industry-standard security tools such as Snyk, GitHub Advanced Security, Burp Suite, or Fortify. A bachelors degree in Computer Science, Cybersecurity, or equivalent practical experience. Desired, but not required: software development experience in mechanical engineering environments. Desired, but not required: familiarity with AWS, Azure, or GCP, and tools such as Docker, Kubernetes, and Infrastructure as Code. Ability to travel to conferences, vendors, and test sites as needed, and to work occasional longer hours or weekends to support critical needs. Responsibilities: Help us build our application security function in partnership with information security leadership. Review code and service architectures, providing security guidance to engineering teams. Lead threat modeling for applications and services, including new features before development begins. Work with information security leadership to define software security metrics that are useful to our culture. Support security team interviews and onboarding. Assist with incident response and handling, providing escalation support as our organization grows. Integrate, maintain, and automate SAST, DAST, SCA, and secrets-management tools within our CI/CD pipelines. Build and integrate agentic security tools tailored to our needs. Perform manual and automated secure code reviews and targeted penetration testing of web and mobile applications. Help manage our external Vulnerability Disclosure or Bug Bounty programs and turn regulatory compliance requirements into practical engineering tasks. Technologies: AI AWS Azure CI/CD Docker GCP GitHub Support Kubernetes Mobile OWASP Security Web NodeJS Cloud More: We are a renewable energy and ocean technology public benefit corporation working to develop and deploy technologies that harness the oceans energy for sustainable power, computing, and affordable renewable fuels delivered to shore. Our core technology is a node designed to produce energy in harsh ocean conditions for years without human maintenance or intervention. We are headquartered in Portland, Oregon, and our team brings experience from major technology, aerospace, industrial, and research organizations. We operate as a collaborative idea meritocracy where strong ideas can shape our direction. This Lead Application Security Engineer will partner closely with our Director of Information Security and software engineering teams. The role is full time and on site at our Portland offices, lab, and shop. Compensation is $200,000–$260,000, plus company equity. Benefits include flexible paid time off and working hours, health, dental, vision, and disability insurance, access to 401(k) and flexible spending accounts, and relocation assistance to Portland if needed. We value autonomy and work-life balance while occasionally requiring additional hours to meet critical needs. last updated 43 week of 2026