Staff II - Application Security Engineer

Omnissa is the first AI-driven digital work platform, built to support flexible, secure, work-from-anywhere experiences. The Staff II Application Security Engineer will set the technical direction for securing software across Omnissa’s product portfolio and influence architecture and engineering decisions to tackle complex security challenges.

Responsibilities:

• Set technical direction for application security across the portfolio — defining standards, patterns, and guardrails adopted by engineering teams at scale
• Lead threat modeling across distributed, cloud-native, and mobile architectures as a repeatable practice embedded in the development lifecycle, not a one-off exercise
• Define security architecture reference designs that, when followed by engineering teams, remove the need to security-review that aspect on a per-feature basis
• Identify architectural risk early and influence roadmap and design decisions before implementation begins
• Perform manual code review and application security testing across Java and C++ codebases; codify findings into reusable guidance engineers can act on without follow-up
• Scale code review coverage using AI-assisted analysis and custom CodeQL queries tuned to Omnissa's codebase and vulnerability patterns
• Conduct variant analysis to ensure confirmed vulnerability classes are remediated consistently across the codebase, not in isolation
• Triage and validate externally reported vulnerabilities — assess exploitability, severity, and business impact, and drive remediation to closure across team boundaries
• Translate individual findings into systemic recommendations that address root-cause design or implementation gaps across products
• Define and evolve the SDL — identify gaps, drive measurable improvements, and own the iteration cycle
• Improve the feature security review program so security work shifts left into design and scales across teams, rather than landing as a release gate
• Mature the product penetration testing program — define scope, methodology, and cadence; ensure findings drive systemic fixes, not one-off patches
• Build and scale the security champions program; mentor engineers and create training that extends security capability beyond the security team
• Establish metrics that make program effectiveness visible to engineering and product leadership

Requirements:

• 12+ years of hands-on application security experience, with demonstrated technical depth and a track record of influence beyond your own work
• Deep knowledge of application security vulnerabilities and mitigation techniques, and the judgment to prioritize them by real business and customer impact
• Proven ability to lead threat modeling, secure design, and security architecture for complex distributed and cloud-native systems
• Proficiency in Java or C++, with the ability to read, reason about, and review production code
• Security breadth across multiple domains — application, system, cloud, and mobile
• A demonstrated history of driving technical change and raising the security bar across teams, and of mentoring senior engineers
• Excellent documentation and communication skills, including the ability to influence engineering and product leadership
• Self-starter who is adaptable, works independently, and brings clarity to ambiguous problems
• A pragmatic mindset; able to identify practical short term and long term strategic solutions
• Experience testing agentic AI systems, and the ability to leverage AI tooling across security testing, triage, and documentation workflows
• Experience building automation solutions that improve the security process at scale
• Prior experience as a pen tester for a multi-tenant SaaS provider