Senior II Security Engineer - Application

Stack

Responsibilities

• ▹Own application and product security, partnering with engineering teams to improve outcomes across the full SDLC
• ▹Act as a strong technical voice in designing, building, shipping, and operating secure systems
• ▹Work hands-on with the core backend stack (Python, Django), reading and writing code, building automation
• ▹Participate in architecture discussions and design reviews to identify risk early
• ▹Lead and facilitate threat modeling for new features and significant changes
• ▹Improve the secure SDLC end-to-end: requirements, secure design, implementation, testing, release, operational readiness
• ▹Build "paved paths" and guardrails that make secure choices the default (libraries, patterns, templates, CI checks)
• ▹Mature code and application security tooling: SAST, SCA (Snyk), secret scanning, DAST/API testing
• ▹Improve vulnerability management: triage, prioritization, remediation, verification, trend reporting
• ▹Create and deliver training and enablement for engineers, grow security champions across teams
• ▹Partner with GRC to ensure security requirements are feasible and evidenced
• ▹Lead engineering-wide initiatives, managing stakeholders and aligning with business

Requirements

• ▹Strong experience in application and product security in modern web environments, improving outcomes across the SDLC
• ▹Strong coding ability (reading, writing, reviewing, proposing improvements) in any language
• ▹Demonstrated experience influencing engineering teams through design reviews and threat modeling
• ▹Strong understanding of common web/API security risks (OWASP Top 10, auth/session risks, SSRF, injection, access control, secrets exposure, unsafe deserialization)
• ▹Experience selecting, introducing, and scaling security tooling in CI/CD (SAST, SCA, secret scanning), tuning to reduce noise
• ▹Ability to turn findings into action with clear severity, ownership, prioritization, verification
• ▹Strong communication skills across Product Engineering, Platform Engineering, SRE, Data, and GRC
• ▹Business-oriented mindset, comfortable with cost-benefit tradeoffs
• ▹Willingness to join on-call rotations and partner with SRE during incidents

Nice to have

• ▹Security experience with identity and authorization patterns (OAuth/OIDC, SSO, RBAC/ABAC), especially SaaS
• ▹Experience with cloud-native environments and security controls (AWS, Kubernetes, infrastructure boundaries)
• ▹Experience building internal security libraries, developer platforms, or guardrails at scale
• ▹Experience with bug bounty programs, pentesting workflows, or coordinated disclosure
• ▹Mobile security experience

Soft skills

What we offer

• ▹Open, collaborative, dynamic and diverse culture
• ▹Generous monthly allowance for lessons on Preply.com, Learning & Development budget and time off for self-development
• ▹Competitive financial package with equity and leave allowance
• ▹Opportunity to unlock the potential of learners and tutors in 175 countries

About the company

Preply is an ed-tech company delivering human-led, tech-enabled language learning experiences: 100,000+ tutors teach 90+ languages to learners in 180 countries. The company recently reached unicorn status with a $150M Series D and is shaping the future of education at global scale.