Staff Application Security Engineer

Responsibilities

You will lead the design and implementation of a secure development lifecycle and manage security tooling pipelines to protect the platform. Additionally, you will perform hands-on security testing, threat modeling, and mentor engineering teams to foster a strong security culture.

Requirements

The role requires over 8 years of software or security engineering experience with at least 5 years specifically in application security. Candidates must possess strong coding skills in languages like TypeScript, Go, or Python and deep expertise in OWASP Top 10 and modern security tooling.

Skills

• Application Security
• Secure SDLC
• Threat Modeling
• TypeScript
• JavaScript
• Go
• Python
• SAST
• DAST
• SCA
• Vulnerability Management
• API Security
• Cloud Security
• CI/CD
• Incident Response
• AI-assisted Security

About this role

Fingerprint empowers enterprises to detect and stop online fraud with the world’s most accurate device intelligence. We lead our industry with bleeding-edge identification capabilities and work on turning new ideas and discoveries in the fraud detection space into reality. Our customers range from innovative startups to leading enterprise companies, including Plaid, Dropbox, and Booking.com.
Fingerprint is a globally dispersed, 100% remote company. We were named on on the 2026 Forbes Best Startup Employers list and ranked #803 on the 2026 Inc. 5000 list of America’s fastest-growing private companies.
We have raised $77M and are backed by Craft Ventures (Tesla, Facebook, Airbnb ), Nexus Venture Partners ( Postman, Apollo.io, MinIO, Druva) and Uncorrelated Ventures ( Redis, Rollbar, Gradle).
The Role in Context
Fingerprint's device intelligence platform processes billions of identification events for some of the world's most security-conscious companies — financial institutions, fraud prevention operators, and enterprises that rely on us to stop attackers. That makes our own application security a product feature, not a back-office function: our customers' adversaries are, by definition, motivated to probe what we build.
As we scale with large enterprise customers, we're investing in application security as a dedicated, first-class engineering discipline. Security is already part of how our teams build — scanning in the pipeline, a Cloud Platform team that treats security as a partner, and a mature compliance posture — and we're now standing up a focused AppSec function, led by a Senior Manager, Application Security who owns the program and strategy, to take it to the next level. You will be the founding senior engineer of that function — the person who turns strategy into a working secure SDLC, finds and fixes what matters, and raises the security bar across engineering through technical depth, tooling, and influence.
This is a hands-on Staff role. You will design, build, and operate — not just advise.

What You'll Do
Secure SDLC & Security Engineering
Design and build Fingerprint's secure development lifecycle: security requirements, threat modeling at design time, secure code review, and pre-release security testing — integrated into how engineers already work, not bolted on as a gate
Own and operate the security tooling pipeline: SAST, DAST, SCA/dependency scanning, secrets detection, and container/IaC scanning (Snyk and equivalents) — tuned for signal over noise, integrated into CI/CD, with clear ownership and SLAs for findings
Build the pipeline AI-first: AI-assisted triage and auto-remediation, security review agents that run inside the coding-agent loop and in CI, and AI-augmented testing — and decide, with evidence, what each is trusted to block, flag, or fix on its own
Build paved-road security: secure defaults, hardened libraries and frameworks, reusable patterns (authn/authz, input validation, secrets handling, crypto) that make the secure path the easy path
Write code. Contribute fixes, security libraries, CI integrations, and automation directly to engineering repositories
Threat Modeling, Security Reviews & Vulnerability Management
Lead threat modeling and architecture security reviews for new products, features, and significant changes across the API, SDKs (web and mobile), dashboard, and data pipeline
Run and mature the vulnerability management program: triage, risk-rate, and drive remediation of findings from scanners, pen tests, bug bounty, and customer reports — with clear severity standards and remediation SLAs
Partner with the Compliance Lead, who runs the penetration testing program today, on scoping, retesting, and turning findings into engineering work — you bring the technical depth and own remediation
Perform hands-on security testing of Fingerprint's platform — manual review and exploitation of authn/authz, API, injection, SSRF, business-logic, and abuse-path issues — with particular attention to the fraud and bot-detection threat surface where adversaries actively attempt to defeat the product
Incident Response & Detection (application layer)
Serve as the technical lead for application-layer security incidents: investigation, containment, root cause, and remediation — partnering with Cloud Platform on infrastructure incidents
Define what application security logging and alerting should exist, and partner with Cloud Platform and engineering teams to get it built
Security Culture & Enablement
Act as the AppSec partner to engineering teams: office hours, design consultations, secure coding guidance, and a Security Champions program that scales your impact beyond one person
Develop and deliver practical secure coding training grounded in Fingerprint's real codebase and real findings
Mentor engineers in security thinking and raise the bar through code review and design feedback
Partnership & Customer Trust
Partner with the Senior Manager, Application Security on the AppSec roadmap: bring technical findings, risk assessments, and recommendations that shape priorities; own execution of the technical program
Provide the engineering evidence behind security controls when compliance needs it — you make the controls real; the compliance program is owned elsewhere
Support enterprise customer security conversations with technical depth: questionnaires, architecture questions, pen test summaries, and due diligence calls with customer InfoSec teams
Contribute to vendor security assessments where third-party code or integrations touch the platform

What We're Looking For
Required
8+ years in software engineering and/or security engineering, with 5+ years focused on application security — you've been the hands-on AppSec engineer at a product company, not a consultant or auditor passing through
Strong software engineering foundation: You write production-quality code (TypeScript/JavaScript, Go, Python, or similar), understand modern web and API architectures, and are comfortab...

About Fingerprint

Software Development · 201-500 employees · headquartered in Chicago, Illinois · founded 2020