Staff Application Security Engineer

Stack

Responsibilities

• ▹Lead threat modeling and design reviews from ideation to production code: security architecture reviews for complex systems, new products and platform initiatives
• ▹Define the technical roadmap and standards for the Application Security program
• ▹Mentor product and engineering teams on security features, product defense, secure coding, architecture and vulnerability remediation
• ▹Develop training materials for engineers to build a foundation of security best practices
• ▹Perform and lead in-depth secure code reviews, manual and tool-assisted, including logic and authorization vulnerabilities that automated tools often miss
• ▹Get hands-on assessing AI models, agents and architectures
• ▹Lead internal penetration testing for new products and historical systems
• ▹Design and improve the end-to-end vulnerability management program in a developer-friendly way
• ▹Serve as an expert on the products for the security incident response team in investigating and resolving incidents

Requirements

• ▹10+ years of direct experience in an Application Security role, designing and implementing security improvements at scale
• ▹Deep proficiency in one or more major programming languages (Python and NextJS a big plus) and a solid software development background
• ▹Extensive experience securing applications deployed in cloud environments (GCP a big plus) and knowledge of containerization technologies (Kubernetes)
• ▹Expert-level knowledge of web application security, APIs, IAM (identity, authentication/authorization, RBAC, ABAC) and applied cryptography
• ▹Deep understanding of the security of AI and ML models, agents and associated systems
• ▹A builder's mindset and excellent communication skills to influence security culture across the organization

Nice to have

• ▹Contributing to or using open-source security tools, publishing security research, managing bug bounty programs and active engagement in the security industry
• ▹Demonstrated ability to drive large, cross-functional technical projects that affect security posture across the organization
• ▹Experience defining and using security metrics to report on AppSec program effectiveness to technical and executive audiences

Soft skills

What we offer

• ▹14 paid holidays and flexible PTO for salaried employees
• ▹Medical, dental and vision coverage for full-time employees and their families
• ▹Monthly company HSA contributions with a High Deductible Health Plan
• ▹Generous paid parental leave
• ▹Family forming benefits
• ▹401(k) matching
• ▹Tax-free personal device allowance
• ▹Pre-tax benefits (FSA and commuter benefits)
• ▹Monthly Lifestyle Wallet for fitness, professional development, coworking and more
• ▹Mental health support: therapy and coaching
• ▹Paid sabbatical leave after 5 years
• ▹Competitive compensation and equity grants for full-time employees

About the company

Abridge was founded in 2018 to power deeper understanding in healthcare. Its AI platform turns patient-clinician conversations into structured clinical notes in real time, with deep EMR integrations. It has offices in San Francisco, New York and Pittsburgh.