Senior Application Security Engineer

BioRender is on a mission to accelerate the world’s ability to learn, discover, and communicate science. They are seeking a Senior Application Security Engineer to contribute directly to the codebase, define security processes, and build developer-friendly security systems while working with AI-powered capabilities.

Responsibilities:

• Contribute production-quality code directly to the application (Node.js/React) and infrastructure (Python, Terraform) – you ship fixes and hardening yourself, not just findings for others to action
• Build and maintain security and CI/CD tooling for automation, keeping the secure path the default path
• Act as a security reviewer on RFCs and design documents, and pair with engineers to resolve issues at the source
• Define secure-by-design patterns and drive standards for authentication, authorization, and API security
• Lead threat modeling on new and existing systems and turn those models into shipped controls
• Own and evolve the Secure SDLC and CI/CD security integration (SAST/DAST/SCA/secrets) – tuned for high signal and low noise
• Work AI-natively: use AI coding assistants and agentic tooling to accelerate code review, triage, and tooling development
• Secure AI-integrated product features – reasoning about prompt injection, data leakage, and over-scoped tool, token, and data access
• Automate recurring security work so the team scales through leverage, not headcount
• Perform penetration testing and code reviews (Node.js/React) using OWASP methodology
• Drive identification and remediation of application security vulnerabilities (SAST/DAST/HackerOne)
• Own the bug bounty program end to end – issue evaluation, reproduction, and closing findings by shipping fixes

Requirements:

• Demonstrable software engineering ability – you read code fluently, write production-quality code that engineers respect, and have contributed to real codebases (Node.js/React; Python a plus)
• Fluency using AI development tools (AI coding assistants, agentic workflows) to get the job done, and a clear-eyed view of the security risks they introduce
• Expertise in web application security and secure-coding best practices, and the ability to review code and application findings
• Experience integrating and maintaining SAST/DAST systems within CI/CD, and with Secure Software Development Life Cycles
• Hands-on experience securing cloud workloads on AWS and comfort with infrastructure-as-code (Terraform or equivalent); familiarity with Cloudflare a plus
• Threat-modeling experience and command of common code and network vulnerability types, their impact, and remediation
• Applied knowledge of cryptography, PKI, and TLS and their practical implementation
• Experience hardening LLM-integrated or AI-powered features in production
• Experience operating a bug bounty program (e.g. HackerOne)
• Contributions to SOC 2 control design and audit readiness from the engineering side
• Relevant certifications (e.g. OSCP, OSWE, AWS Security Specialty) – valued, but not a substitute for engineering ability