Sr. Application Security Engineer

Mitek Systems is a global leader in digital and biometric identity authentication solutions. They are seeking a Senior Application Security Engineer to be the technical authority on the security of their software products, focusing on vulnerability remediation and embedding security into the software development lifecycle.

Responsibilities:

• Own the application vulnerability remediation program with prioritized developer guidance and clear SLAs
• Work with development squads to explain findings, validate fixes, and confirm remediation
• Drive systemic root-cause fixes rather than one-by-one patching; escalate unresolved criticals and highs
• Define and own the SDLC — security gates and review checkpoints in sprint and release processes
• Ensure SAST, DAST, and SCA tooling is configured, tuned, and producing actionable developer output
• Embed security requirements into product planning and architecture decisions
• Threat-model new features and architectural changes before code is written
• Review designs for authentication, authorization, data-flow, and cryptographic risk
• Produce written threat models that serve as developer guidance and audit evidence
• Own API security standards — OAuth 2.0, mTLS, rate limiting, and abuse prevention
• Conduct or coordinate manual secure code review of security-sensitive components
• Lead application penetration-testing cycles — scoping, managing testers, validating findings
• Build and run a Security Champions program across development squads
• Deliver developer security training on OWASP Top 10 and secure-coding patterns
• Create runbooks, coding standards, and pattern libraries developers can apply independently

Requirements:

• Knowledge, skills and abilities typically gained through 5–8 years in application/product security or security-focused software engineering
• Application penetration testing including business-logic and API testing
• Hands-on SAST, DAST, and SCA tuning and operationalization
• Secure code review across at least two web-application languages
• Threat modeling using STRIDE, PASTA, or equivalent
• Depth in OWASP Top 10 and API security risks; ability to influence development teams
• Financial services, fintech, or SaaS for regulated industries
• Financial-sector threat knowledge — fraud, account takeover, API abuse
• Cloud-native application security including container security
• PCI-DSS application security requirements
• OSCP, GWEB, or CSSLP
• Prior experience building a Security Champions program