biorender-inc - Senior Application Security Engineer
Requirements
• Demonstrable software engineering ability – you read code fluently, write production-quality code that engineers respect, and have contributed to real codebases (Node.js/React; Python a plus). • Fluency using AI development tools (AI coding assistants, agentic workflows) to get the job done, and a clear-eyed view of the security risks they introduce. • Expertise in web application security and secure-coding best practices, and the ability to review code and application findings. • Experience integrating and maintaining SAST/DAST systems within CI/CD, and with Secure Software Development Life Cycles. • Hands-on experience securing cloud workloads on AWS and comfort with infrastructure-as-code (Terraform or equivalent); familiarity with Cloudflare a plus. • Threat-modeling experience and command of common code and network vulnerability types, their impact, and remediation. • Applied knowledge of cryptography, PKI, and TLS and their practical implementation. • Experience hardening LLM-integrated or AI-powered features in production. • Experience operating a bug bounty program (e.g. HackerOne). • Contributions to SOC 2 control design and audit readiness from the engineering side. • Relevant certifications (e.g. OSCP, OSWE, AWS Security Specialty) – valued, but not a substitute for engineering ability.
Responsibilities
• Hands-on engineering & codebase contribution • Contribute production-quality code directly to the application (Node.js/React) and infrastructure (Python, Terraform) – you ship fixes and hardening yourself, not just findings for others to action. • Build and maintain security and CI/CD tooling for automation, keeping the secure path the default path. • Act as a security reviewer on RFCs and design documents, and pair with engineers to resolve issues at the source. • Architecture, design & secure SSDLC • Define secure-by-design patterns and drive standards for authentication, authorization, and API security. • Lead threat modeling on new and existing systems and turn those models into shipped controls. • Own and evolve the Secure SDLC and CI/CD security integration (SAST/DAST/SCA/secrets) – tuned for high signal and low noise. • AI-native security & automation • Work AI-natively: use AI coding assistants and agentic tooling to accelerate code review, triage, and tooling development. • Secure AI-integrated product features – reasoning about prompt injection, data leakage, and over-scoped tool, token, and data access. • Automate recurring security work so the team scales through leverage, not headcount. • Web & product security (active defense) • Perform penetration testing and code reviews (Node.js/React) using OWASP methodology. • Drive identification and remediation of application security vulnerabilities (SAST/DAST/HackerOne). • Own the bug bounty program end to end – issue evaluation, reproduction, and closing findings by shipping fixes.
Benefits
• We are mission-driven: we work collaboratively towards our shared vision of improving scientific communication and accelerating scientific discovery. BioRender figures have appeared in more than 54,000 publications! • BioRender is loved by millions! We have a world-class NPS and a community of loyal fans and users in 200+ countries! • Our company is backed by top investors and accelerators like Y Combinator, and we are on a growth trajectory comparable to many top-performing SaaS companies • We’re remote-first with team members across Canada and the U.S., offering you the flexibility to work from anywhere.
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT