Application Product Security Engineer

Jump is a company that builds AI-powered tools to assist financial advisors in automating their workflows, prioritizing security in their product. They are seeking an Application & Product Security Engineer who will work closely with engineering and product teams to integrate security into the product development process.

Responsibilities:

• Partner with product and engineering teams during design and planning to identify risks early and build security into new features from the start
• Lead threat modeling and secure design reviews for new products, features, and architecture changes
• Perform security-focused code reviews and help engineers fix vulnerabilities — and understand how to avoid them next time
• Build and maintain application security tooling (SAST, dependency scanning, secrets detection) integrated into CI/CD
• Participate in incident response: triage, investigate, contain, and drive post-incident learning
• Triage findings from bug bounty reports, pen tests, and vulnerability scans, and drive remediation with owning teams
• Develop lightweight security guidance, paved-road patterns, and training that make the secure way the easy way
• Wear multiple hats as needed — from customer security questionnaires to cloud and corporate security improvements

Requirements:

• 2–4 years of experience in application security, product security, or a software engineering role with significant security responsibilities
• Solid grasp of common vulnerability classes (OWASP Top 10, authn/authz flaws, injection, SSRF) and how to prevent them in real codebases
• Experience with threat modeling and secure design review, and the ability to explain risk in terms engineers and PMs care about
• Hands-on incident response experience — you've helped detect, investigate, or contain real security events
• Ability to read and write code (e.g., Python, TypeScript/JavaScript, Go, or similar) well enough to review PRs and build small tools
• Strong communication and collaboration skills — you build trust with engineers rather than throwing findings over the wall
• Comfort with ambiguity and shifting priorities; you can self-direct and wear multiple hats
• Prior security experience at a startup or on a small security team (a major plus)
• Cloud security experience (AWS, GCP, or Azure) and infrastructure-as-code familiarity
• Experience securing AI/LLM-powered products or working with sensitive financial data
• Familiarity with compliance frameworks (SOC 2, GDPR) as they relate to product security
• Contributions to CTFs, bug bounty, open-source security tools, or security community involvement