Staff Application Security Engineer

Fingerprint empowers enterprises to detect and stop online fraud with the world’s most accurate device intelligence. We lead our industry with bleeding-edge identification capabilities and work on turning new ideas and discoveries in the fraud detection space into reality. Our customers range from innovative startups to leading enterprise companies, including Plaid, Dropbox, and Booking.com. Fingerprint is a globally dispersed, 100% remote company. We were named on on the 2026 Forbes Best Startup Employers list and ranked #803 on the 2026 Inc. 5000 list of America’s fastest-growing private companies. We have raised $77M and are backed by Craft Ventures (Tesla, Facebook, Airbnb), Nexus Venture Partners (Postman, Apollo.io, MinIO, Druva) and Uncorrelated Ventures (Redis, Rollbar, Gradle). The Role in Context Fingerprint's device intelligence platform processes billions of identification events for some of the world's most security-conscious companies — financial institutions, fraud prevention operators, and enterprises that rely on us to stop attackers. That makes our own application security a product feature, not a back-office function: our customers' adversaries are, by definition, motivated to probe what we build. As we scale with large enterprise customers, we're investing in application security as a dedicated, first-class engineering discipline. Security is already part of how our teams build — scanning in the pipeline, a Cloud Platform team that treats security as a partner, and a mature compliance posture — and we're now standing up a focused AppSec function, led by a Senior Manager, Application Security who owns the program and strategy, to take it to the next level. You will be the founding senior engineer of that function — the person who turns strategy into a working secure SDLC, finds and fixes what matters, and raises the security bar across engineering through technical depth, tooling, and influence. This is a hands-on Staff role. You will design, build, and operate — not just advise. What You'll Do Secure SDLC & Security Engineering - Design and build Fingerprint's secure development lifecycle: security requirements, threat modeling at design time, secure code review, and pre-release security testing — integrated into how engineers already work, not bolted on as a gate. - Own and operate the security tooling pipeline: SAST, DAST, SCA/dependency scanning, secrets detection, and container/IaC scanning (Snyk and equivalents) — tuned for signal over noise, integrated into CI/CD, with clear ownership and SLAs for findings. - Build the pipeline AI-first: AI-assisted triage and auto-remediation, security review agents that run inside the coding-agent loop and in CI, and AI-augmented testing — and decide, with evidence, what each is trusted to block, flag, or fix on its own. - Build paved-road security: secure defaults, hardened libraries and frameworks, reusable patterns (authn/authz, input validation, secrets handling, crypto) that make the secure path the easy path. - Write code. Contribute fixes, security libraries, CI integrations, and automation directly to engineering repositories. Threat Modeling, Security Reviews & Vulnerability Management - Lead threat modeling and architecture security reviews for new products, features, and significant changes across the API, SDKs (web and mobile), dashboard, and data pipeline. - Run and mature the vulnerability management program: triage, risk-rate, and drive remediation of findings from scanners, pen tests, bug bounty, and customer reports — with clear severity standards and remediation SLAs. - Partner with the Compliance Lead, who runs the penetration testing program today, on scoping, retesting, and turning findings into engineering work — you bring the technical depth and own remediation. - Perform hands-on security testing of Fingerprint's platform — manual review and exploitation of authn/authz, API, injection, SSRF, business-logic, and abuse-path issues — with particular attention to the fraud and bot-detection threat surface where adversaries actively attempt to defeat the product. Incident Response & Detection (application layer) - Serve as the technical lead for application-layer security incidents: investigation, containment, root cause, and remediation — partnering with Cloud Platform on infrastructure incidents. - Define what application security logging and alerting should exist, and partner with Cloud Platform and engineering teams to get it built. Security Culture & Enablement - Act as the AppSec partner to engineering teams: office hours, design consultations, secure coding guidance, and a Security Champions program that scales your impact beyond one person. - Develop and deliver practical secure coding training grounded in Fingerprint's real codebase and real findings. - Mentor engineers in security thinking and raise the bar through code review and design feedback. Partnership & Customer Trust - Partner with the Senior Manager, Application Security on the AppSec roadmap: bring technical findings, risk assessments, and recommendations that shape priorities; own execution of the technical program. - Provide the engineering evidence behind security controls when compliance needs it — you make the controls real; the compliance program is owned elsewhere. - Support enterprise customer security conversations with technical depth: questionnaires, architecture questions, pen test summaries, and due diligence calls with customer InfoSec teams. - Contribute to vendor security assessments where third-party code or integrations touch the platform. What We're Looking For Required - 8+ years in software engineering and/or security engineering, with 5+ years focused on application security — you've been the hands-on AppSec engineer at a product company, not a consultant or auditor passing through. - Strong software engineering foundation: You write production-quality code (TypeScript/JavaScript, Go, Python, or similar), understand modern web and API architectures, and are comfortable working inside engineering repositories and CI/CD pipelines. - Deep practical AppSec expertise: OWASP Top 10 and beyond — authentication and authorization design, API security, injection classes, SSRF, cryptography misuse, business-logic and abuse flaws. You can find these issues by hand, explain why they matter, and propose fixes engineers accept. - Threat modeling and security review experience: You've led design-time security reviews for complex systems and produced threat models that engineers used. - Security tooling program experience: You've deployed and tuned SAST/DAST/SCA/secrets-detection tooling in CI/CD and made it useful rather than noisy. - AI-native security tooling: You've run AI-assisted code analysis, triage, or auto-remediation in a real program — not a trial — and have earned opinions about where it's trustworthy, where it generates noise, and what should be allowed to block a merge. You use AI agents daily in your own security work. - Vulnerability management ownership: You've run triage, severity rating, remediation tracking, and pen-test programs with real SLAs. - Influence without authority: A track record of raising security outcomes across engineering teams through credibility, partnership, and good tooling — not mandates. - Clear communication: You write precise findings and design feedback, and you can explain technical risk to engineers, leadership, and customer security teams alike. Nice to Have - Experience in fraud detection, bot mitigation, identity, or device intelligence — the adversarial threat surface here is real and domain-specific. - Cloud security depth on AWS (IAM, network boundaries, secrets management, workload identity) and familiarity with Wiz or equivalent CSPM tooling. - Client-side and mobile SDK security: browser security model, anti-tampering, obfuscation trade-offs, iOS/Android SDK hardening. - Multi-tenant SaaS experience with high-volume, latency-sensitive APIs. - Bug bounty program operation (HackerOne, Bugcrowd, or equivalent). - AI/ML security awareness: LLM-integrated features, prompt injection, agent tool permissions, model and data-pipeline risks. - Experience with autonomous or AI-augmented penetration testing and attack simulation, and a view on how it complements human-led testing. - Security certifications (OSCP, OSWE, GWAPT, CSSLP) or published research, CVEs, or open-source security contributions. - Experience supporting SOC 2 / ISO 27001 controls as the engineering owner of the control, not the program owner. The Shape of This Role This is the senior individual-contributor counterpart to the Senior Manager, Application Security. The manager owns the program, the strategy, and the team; you own the technical depth and the execution. The two roles are designed to work as a pair: you'll bring the findings, the engineering judgment, and the ground truth from inside the codebase, and together you'll decide what to prioritize. As a Staff engineer, you are expected to operate with a high degree of independence — scoping ambiguous problems, setting technical direction for AppSec, and driving multi-quarter initiatives without needing day-to-day direction. As the founding engineer of a dedicated AppSec function, the patterns, tooling, and standards you establish will be the foundation the practice grows on. This is not a role for someone who wants to primarily write policy or manage a program from a distance. It's for an engineer who finds real bugs, builds real tooling, and earns the trust of other engineers by making their code better. Why This Role? - Shape a dedicated AppSec function from its first days, with a manager and a mandate behind you — this investment is sponsored at the VP level and prioritized. - A security problem that actually matters: Fingerprint's customers use us to stop fraud and abuse. The adversaries are real, skilled, and motivated — the threat model here is more interesting than at most SaaS companies. - Modern stack and tooling already in place: Snyk, Wiz, Cloudflare, Okta, and a Cloud Platform team that treats security as a partner, not an obstacle. - Your time goes to engineering: Compliance, IT, and infrastructure are each owned by capable teams, so you spend your days on code, findings, and tooling — not evidence collection or ticket queues. - Staff-level scope and autonomy: You set the technical direction for application security at a company where security is a differentiator in enterprise sales. Compensation & Transparency At Fingerprint, we believe in pay transparency — it's part of how we operate as a distributed, remote-first team. Salaries are based on function, level, and geographic location, benchmarked against similar stage growth companies. Because this role is open across the United States and can be based anywhere our team members work from, the salary range reflects that geographic breadth: $177k - $240k Some example salaries for specific locations are below: - NYC: $209K - $240k - Chicago: $177K - $204K Final offer amounts are determined by multiple factors, including the successful candidate's location, experience, and expertise, and may vary from the amounts listed above. Due to regulatory and security reasons, there’s a small number of countries where we cannot have Fingerprint teammates based. Additionally, because Fingerprint is an all-remote company and people can join our workforce from almost any country, we do not sponsor visas. Fingerprint teammates need to be authorized to work from their home location. We are dedicated to creating an inclusive work environment for everyone. We embrace and celebrate the unique experiences, perspectives and cultural backgrounds that each employee brings to our workplace. Fingerprint strives to foster an environment where our employees feel respected, valued and empowered, and our team members are at the forefront in helping us promote and sustain an inclusive workplace. We highly encourage people from underrepresented groups in tech to apply. If you are applying as a resident of California, please read our CCPA notice here. If you are applying as a resident of the EU, please read our GDPR notice here. We have noticed a rise in recruiting impersonations across the industry, where scammers attempt to access candidates' personal and financial information through fake interviews and offers. All Fingerprint recruiting email communications will always come from the @fingerprint.com domain. Any outreach claiming to be from Fingerprint via other sources should be ignored.