Senior Application Security Engineer

We need to output HTML fragment with sections: About the role, Responsibilities (What You’ll Do), Requirements (What You’ll Bring), Benefits (Global Benefits & Perks), Pay (Salary), Schedule (maybe location/hybrid). Also maybe About CharterUP? The instruction: use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). Do NOT repeat the job title as a heading. Do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short

or drop it. Preserve ALL substantive information; do NOT invent or summarize away detail. Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. IMPORTANT: include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text (e.g. "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless the posting actually states them. Prefer a few substantive sections over many thin ones. We need to decide which sections to include. We have: - About CharterUP (company description). Could be considered "About the role"? Actually "About The Role" is a heading in posting. So we can have

About the role

with content from "About The Role" paragraph. - Responsibilities: "What You’ll Do" bullet list. - Requirements: "What You’ll Bring" bullet list. - Benefits: "Global Benefits & Perks at CharterUP" with bullet list. - Pay: "Salary: $150,000 USD - $180,000 USD" - Schedule: maybe location/hybrid: "Location: Austin, TX (Hybrid: Monday, Wednesday, Friday in-office)". Also "Reports to: Engineering Manager". Title is not heading. We can include schedule/hybrid info. We also have "Recruiting Process" steps; that is application instructions? Probably we should remove application instructions. The instruction says remove application instructions. So we should drop Recruiting Process. Also "Why Join Us" bullet points maybe could be part of About the role? But we can include as part of About the role? The "Why Join Us" is more about company culture; could be part of About the role or maybe separate section like "About CharterUP". But we have limited headings; we could incorporate into About the role or maybe a separate "About CharterUP" but not in allowed headings list. The allowed headings list includes About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we should stick to those. "Why Join Us" could be considered part of About the role (maybe as a subsection). We'll include it in About the role paragraph. We need to preserve all substantive information. So we need to include details from About CharterUP paragraph (the first paragraph). Also "Why Join Us" bullet points. Also "About The Role" paragraph. Also "Title: Senior Application Security Engineer Reports to: Engineering Manager Location: Austin, TX (Hybrid: Monday, Wednesday, Friday in-office)" - we can embed that in About the role or maybe separate? Probably include in About the role as metadata. We need to use

• for any list of duties/requirements/benefits. So for responsibilities, requirements, benefits we need lists. We need to use

  for prose. We must not repeat the job title as a heading. So no

  Senior Application Security Engineer

  . We must not put Job ID/requisition numbers as headings (none present). We must remove boilerplate: EEO, accommodation, etc. Also remove "CharterUP is an Equal Opportunity Employer..." etc. Also remove "If you require accommodation..." etc. Also remove "Hiring Locations:" list? That is maybe considered metadata but could be part of Schedule? It's about where candidates must reside. Could be considered location requirement. Might be part of Requirements? But it's about hiring locations. Could be included in Requirements as a note. However it's a list of states; it's substantive. Should we include? The instruction says preserve ALL substantive information; do NOT invent or summarize away detail. So we should keep that list. Where to put? Could be under Requirements as a note, or under Schedule? Probably under Requirements as "Hiring Locations". But we need to use
  • for any list. So we can make a list. But we must not create sections with filler. So we need to ensure each section has real content. Thus sections: - About the role: includes company description, Why Join Us bullet points, role overview, title/reports/location/hybrid. - Responsibilities: list from "What You’ll Do". - Requirements: list from "What You’ll Bring" plus maybe hiring locations list. - Benefits: list from "Global Benefits & Perks at CharterUP". - Pay: salary range. - Schedule: maybe hybrid schedule? Could also include location/hybrid info but we already placed location in About the role. Could still have Schedule section for hybrid days. But we might avoid duplication. The instruction: prefer a few substantive sections over many thin ones. Could combine location/hybrid into About the role. Then Schedule may be unnecessary. However we have explicit schedule info: "Hybrid: Monday, Wednesday, Friday in-office". That's schedule. Could be placed under Schedule section. But we already have location in About the role; we could move location/hybrid to Schedule and keep About the role for role description only. Let's think. We need to include all substantive info. If we put location/hybrid in Schedule, we still need to include About the role description (company description, Why Join Us, role overview). That's fine. Thus: About the role: includes company description (About CharterUP), Why Join Us bullet points, and the role overview paragraph ("CharterUP is seeking a Senior Application Security Engineer..."). Responsibilities: list. Requirements: list (What You’ll Bring) plus hiring locations list. Benefits: list. Pay: salary. Schedule: hybrid days. We must not repeat job title as heading; fine. We must not include recruiting process steps. We must not include EEO boilerplate. We must not include "If you require accommodation..." etc. We must not include "CharterUP is an Equal Opportunity Employer..." etc. We must not include "Welcome aboard!" maybe that's fluff but could be considered boilerplate; we can drop. Now produce HTML. Structure:

    About the role

    ... company description ...

    • Why Join Us items

    CharterUP is seeking a Senior Application Security Engineer ...

    Title: Senior Application Security Engineer Reports to: Engineering Manager Location: Austin, TX (Hybrid: Monday, Wednesday, Friday in-office)

    But we moved location/hybrid to Schedule; maybe we keep location only in About the role? Let's decide. If we put location/hybrid in Schedule, we should not duplicate. So About the role will not include location/hybrid. We'll keep just title and reports. Thus About the role: company description, Why Join Us, role overview, title/reports. Responsibilities: list. Requirements: list (What You’ll Bring) + hiring locations list. Benefits: list. Pay: salary. Schedule: hybrid days. Now we need to ensure we don't create empty sections. Let's extract content. Company description paragraph: "CharterUP is transforming the $450+ billion group transportation and mobility market with an AI native platform that powers modern charter, shuttle, and emerging autonomous vehicle operations. Trusted by many Fortune 500 companies, CharterUP connects enterprises, institutions, and event organizers to thousands of bus operators nationwide, while increasingly serving as the operating system for large scale shuttle and transit programs across airports, campuses, industrial sites, and major events. Through real time availability, transparent pricing, intelligent routing, and AI driven dispatch and optimization, CharterUP replaces a fragmented and opaque industry with automation, accountability, and scale." Why Join Us bullet points: - Innovative Impact: Be part of the team that's revolutionizing group travel, setting new standards in an industry overdue for change. - Growth Opportunities: As a hyper growth company and one of the fastest-growing companies recognized by Inc., there’s no better time to join our dynamic, growth-stage organization. - Driven Team: Collaborate with some of the most driven minds in tech, all while working in a remote-first environment with a tech hub in Austin, TX. - Funding and Stability: Our $60 million Series A funding was just the start—we’re poised for even greater expansion, and you can be part of this exciting journey. CharterUp has achieved this growth profitability and efficiently, ensuring long-term stability. Note: "CharterUp" capitalization but fine. Role overview paragraph: "CharterUP is seeking a Senior Application Security Engineer to raise the bar on how we build and ship secure software. This is a dedicated security role on the Platform Engineering team. Our applications handle customer PII, passenger manifests, trip and location data, and payment flows, and they enforce authorization boundaries between thousands of parties in a two-sided marketplace. You'll be the technical leader on application security here, setting our standards, defining what "secure enough to ship" means, owning security decisions in design and code review, and driving vulnerabilities through remediation. Expect to split your time roughly evenly between building security tooling and automation and conducting threat modeling, design reviews, and targeted code reviews." Title line: "Title: Senior Application Security Engineer Reports to: Engineering Manager" We could also include location? We'll put location/hybrid in Schedule. Now Responsibilities list (What You’ll Do): - Own security tooling and vulnerability management across SAST, dependency and container scanning, secret detection, and penetration testing, including triage, routing, and remediation SLAs - Lead security design reviews, threat modeling, and targeted manual code reviews for high-risk systems, including authentication, authorization, payments, and customer data - Identify and prevent multi-tenant authorization vulnerabilities across quoting, booking, and trip workflows through scalable patterns and automated testing - Strengthen AWS security through IAM and account boundary design, secrets management, workload protection, and comprehensive logging - Scale security across engineering by building secure defaults, reusable libraries, automation, and developer guardrails, and establishing a security champions practice Now Requirements list (What You’ll Bring): - 5+ years of experience in software engineering or security, including 3+ years in application or product security - Strong software engineering skills in Java and/or TypeScript, with experience building production-grade security tooling, automation, libraries, and developer-facing solutions - Deep expertise in application security, including threat modeling, secure system design, authentication, authorization, access control, injection, SSRF, and manual code review; familiarity with security and compliance standards, including SOC 2, PCI DSS, and GDPR is a plus. - Hands-on experience with AWS and cloud-native security, including IAM, multi-account architecture, containerized workloads, CI/CD security, and vulnerability management - Strong technical judgment and influence, with the ability to set security standards, prioritize risk, and drive remediation across engineering teams without direct authority Now Hiring Locations list: "Hiring Locations: CharterUP U.S.-based candidates and employees must reside in one of the following states: Arizona, Colorado, Florida, Georgia, Hawaii, Mississippi, Missouri, North Carolina, New Hampshire, Nevada, New York, Oklahoma, South Dakota, Tennessee, Texas, Utah, Washington, and Wyoming. We hire in the U.S. and Canada and are actively expanding our global footprint." We can turn into list items. Now Benefits list (Global Benefits & Perks at CharterUP): - Flexible Work Model: CharterUP operates as a remote-first company, with select roles requiring regular, in-office presence based on team and business needs. Role-specific expectations will be shared during the hiring process. U.S.-based employees may reside in any of our 19 approved states. -