jump-app - Application Product Security Engineer

• Partner with product and engineering teams during design and planning to identify risks early and build security into new features from the start. • Lead threat modeling and secure design reviews for new products, features, and architecture changes. • Perform security-focused code reviews and help engineers fix vulnerabilities — and understand how to avoid them next time. • Build and maintain application security tooling (SAST, dependency scanning, secrets detection) integrated into CI/CD. • Participate in incident response: triage, investigate, contain, and drive post-incident learning. • Triage findings from bug bounty reports, pen tests, and vulnerability scans, and drive remediation with owning teams. • Develop lightweight security guidance, paved-road patterns, and training that make the secure way the easy way. • Wear multiple hats as needed — from customer security questionnaires to cloud and corporate security improvements. • Solid grasp of common vulnerability classes (OWASP Top 10, authn/authz flaws, injection, SSRF) and how to prevent them in real codebases. • Experience with threat modeling and secure design review, and the ability to explain risk in terms engineers and PMs care about. • Hands-on incident response experience — you’ve helped detect, investigate, or contain real security events. • Ability to read and write code (e.g., Python, TypeScript/JavaScript, Go, or similar) well enough to review PRs and build small tools. • Strong communication and collaboration skills — you build trust with engineers rather than throwing findings over the wall. • Comfort with ambiguity and shifting priorities; you can self-direct and wear multiple hats.