Senior Security Engineer, Application Security
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). Use - for any list of duties/requirements/benefits, and
for prose. Do NOT repeat the job title as a heading. Do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short
or drop it. Preserve ALL substantive information; do NOT invent or summarize away detail. Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. IMPORTANT: include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text (e.g. "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless the posting actually states them. Prefer a few substantive sections over many thin ones.
Thus we need sections: About the role (we have "About The Role" heading). Responsibilities? The role description includes many bullet-like sentences; we could treat them as responsibilities. Could create a Responsibilities section with
- . Qualifications section with list. Pay section with base range. Benefits? Not mentioned besides maybe not. Schedule? Not mentioned. Skills? Could be part of qualifications. But we should avoid thin sections. Perhaps combine Qualifications and Skills into one Qualifications section. Provide Pay section.
We need to remove EEO statement etc. Also remove "Why Kikoff" maybe not needed as it's not a required heading; but we could incorporate into About the role? Actually "Why Kikoff" is separate paragraph about company culture; but we could drop as not required? The instruction: preserve ALL substantive information; do NOT invent or summarize away detail. So we should keep that info somewhere. Could include as a short
under About the role or as a separate section like "About Kikoff"? But headings list only given examples; we could still use
for any heading we want, but they gave examples. Probably we should include a section "About Kikoff" if we want to keep that info. However they said use for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). That suggests we should stick to those headings; but we could also use other headings if needed? Safer to stick to those. The "Why Kikoff" could be considered part of "About the role" or maybe we can drop it as it's not a required heading but it's substantive. However instruction: Preserve ALL substantive information; do NOT invent or summarize away detail. So we must keep it. Could embed it in a
after the About the role heading, before responsibilities list.
Thus structure:
About the role
[Why Kikoff paragraph? Actually "Why Kikoff" is separate; we could combine.] Then the paragraph about role: "Kikoff exists to help millions..." etc.]
Then responsibilities: we can make a
Responsibilities
with - items extracted from the bullet-like sentences under "In This Role, You Will Drive the Pillar" etc.
Then qualifications:
Qualifications
with - items from Qualifications and Bonus Points.
Then pay:
Pay
with Base Range $268,000 - $321,000 USD
We should not include Benefits or Schedule.
We must output only HTML fragment, no markdown fences.
Let's extract responsibilities:
From text after "About The Role" paragraph:
"You will drive and help shape the application security roadmap. You define the strategy, sequence the work, and drive it to done. Engineers ship fast here, and increasingly with AI agents writing code alongside them. Your job is to make that speed safe by default.
In This Role, You Will Drive the Pillar Drive the application security roadmap: secure SDLC, code review, threat modeling, vulnerability management, and the pentest and bug bounty programs.Set the standard for what secure code looks like at Kikoff and build the tooling that enforces it: SAST, SCA, secrets scanning, and dependency policy wired into CI with signal engineers trust.Decide how AI-generated code gets reviewed and gated. Design the controls for a codebase where agents are contributors. Build & Secure Build paved roads into the frameworks engineers use: authn/authz libraries, input validation, safe defaults for common patterns, so the secure way is the only way most engineers encounter.Own security for our authentication and session layer: MFA design, account recovery, session management, and defenses against credential stuffing and account takeover.Secure our APIs and mobile apps: authorization models, rate limiting, abuse controls, certificate pinning, and secure storage on device.Secure the AI features we ship to customers: prompt injection defenses, tool permission boundaries, and data exposure controls for LLM-backed flows. Prove It Run the penetration testing and bug bounty programs. Triage, drive remediation, and close the loop with engineering.Build vulnerability management that holds up in front of auditors: defined SLAs, tracked remediation, and evidence that stands on its own for PCI-DSS, SOC 2, and IPO-readiness controls.Threat model new products and major features before they ship, not after. Enable Engineering Be the security engineer product engineers actually want in their design reviews. Clear answers, fast turnaround, real fixes.Stand up and run a security champions program so AppSec scales past one person.Build internal tooling, including AI-assisted review and triage, that multiplies the team's reach."
We need to break into list items. Could group similar items.
Let's create list items:
- Drive the application security roadmap: secure SDLC, code review, threat modeling, vulnerability management, and penetration testing & bug bounty programs.
- Set the standard for secure code and build tooling (SAST, SCA, secrets scanning, dependency policy) integrated into CI.
- Define review and gating processes for AI-generated code; design controls for agent-contributed codebase.
- Build secure frameworks: authn/authz libraries, input validation, safe defaults for common patterns.
- Own security for authentication and session layer: MFA design, account recovery, session management, defenses against credential stuffing and account takeover.
- Secure APIs and mobile apps: authorization models, rate limiting, abuse controls, certificate pinning, secure storage on device.
- Secure AI features shipped to customers: prompt injection defenses, tool permission boundaries, data exposure controls for LLM-backed flows.
- Run penetration testing and bug bounty programs; triage, drive remediation, close loop with engineering.
- Build vulnerability management with defined SLAs, tracked remediation, audit-ready evidence for PCI-DSS, SOC 2, IPO-readiness.
- Threat model new products and major features before they ship.
- Act as security engineer in design reviews: provide clear answers, fast turnaround, real fixes.
- Establish and run a security champions program to scale AppSec.
- Develop internal tooling, including AI-assisted review and triage, to multiply team reach.
That seems comprehensive.
Qualifications:
From "Qualifications" paragraph:
"6+ years in security engineering with deep, hands-on application security experience: secure code review, threat modeling, vulnerability triage, and remediation at scale
You write production code. Fluency in at least one of Ruby, Python, Go, or TypeScript, and comfort reading all of them
You have designed and shipped authentication and authorization systems, not just reviewed them. OAuth/OIDC, session management, MFA, account recovery
Hands-on with modern AppSec tooling and the judgment to know when it is wrong: SAST, SCA, DAST, secrets scanning, CI/CD integration
Experience securing REST/GraphQL APIs and native mobile applications
You have run or built a pentest or bug bounty program
Comfortable in a fintech regulated environment: PCI-DSS, SOC 2, or similar"
Bonus Points:
"Bonus Points Securing LLM-backed product features or agentic workloads in production
Fraud and abuse defense: bot detection, credential stuffing mitigation, device signals
Security champions or developer education programs you started, not inherited
Supply chain security depth: dependency provenance, artifact signing, build integrity
Consumer fintech or financial services background"
We can combine into qualifications list, maybe separate "Bonus Points" as optional but still qualifications. Could just include all as list items.
Let's create list items:
- 6+ years in security engineering with deep, hands-on application security experience: secure code review, threat modeling, vulnerability triage, and remediation at scale.
- Write production code; fluency in at least one of Ruby, Python, Go, or TypeScript, and comfort reading all of them.
- Designed and shipped authentication and authorization systems (OAuth/OIDC, session management, MFA, account recovery).
- Hands‑on with modern AppSec tooling (SAST, SCA, DAST, secrets scanning, CI/CD integration) and judgment to know when it is wrong.
- Experience securing REST/GraphQL APIs and native mobile applications.
- Have run or built a penetration testing or bug bounty program.
- Comfortable in a fintech regulated environment (PCI‑DSS, SOC 2, or similar).
- Bonus: Experience securing LLM‑backed product features or agentic workloads in production.
- Bonus: Fraud and abuse defense (bot detection, credential stuffing mitigation, device signals).
- Bonus: Built security champions or developer education programs (not inherited).
- Bonus: Supply chain security depth (dependency provenance, artifact signing, build integrity).
- Bonus: Consumer fintech or financial services background.
Pay: Base Range $268,000 - $321,000 USD.
Now we need to output HTML fragment.
We'll start with
About the role
then a containing the Why Kikoff paragraph plus the role description paragraph.
Why Kikoff paragraph: "This is a consumer fintech startup, and you will be working with serial entrepreneurs who have built strong consumer brands and innovative products. We value extreme ownership, clear communication, a strong sense of craftsmanship, and the desire to create lasting work and work relationships. Yes, you can build an exciting business AND have real-life real-customer impact."
Then role description paragraph: "Kikoff exists to help millions of people build credit. That only works if the products they use are safe. This role helps shape the Application Security pillar at Kikoff: how code gets written, reviewed, shipped, and defended across our web, mobile, and API surfaces. You will drive and help shape the application security roadmap. You define the strategy, sequence the work, and drive it to done. Engineers ship fast here, and increasingly with AI agents writing code alongside them. Your job is to make that speed safe by default."
We could combine into one
or two
. Use
for prose; we can have multiple
under the heading.
Thus:
About the role
This is a consumer fintech startup, and you will be working with serial entrepreneurs who have built strong consumer brands and innovative products. We value extreme ownership, clear communication, a strong sense of craftsmanship, and the desire to create lasting work and work relationships. Yes, you can build an exciting business AND have real-life real-customer impact.
Kikoff exists to help millions of people build credit. That only works if the products they use are safe. This role helps shape the Application Security pillar at Kikoff: how code gets written, reviewed, shipped, and defended across our web,
for prose. Do NOT repeat the job title as a heading. Do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short
or drop it. Preserve ALL substantive information; do NOT invent or summarize away detail. Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. IMPORTANT: include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text (e.g. "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless the posting actually states them. Prefer a few substantive sections over many thin ones. Thus we need sections: About the role (we have "About The Role" heading). Responsibilities? The role description includes many bullet-like sentences; we could treat them as responsibilities. Could create a Responsibilities section with
- . Qualifications section with list. Pay section with base range. Benefits? Not mentioned besides maybe not. Schedule? Not mentioned. Skills? Could be part of qualifications. But we should avoid thin sections. Perhaps combine Qualifications and Skills into one Qualifications section. Provide Pay section.
We need to remove EEO statement etc. Also remove "Why Kikoff" maybe not needed as it's not a required heading; but we could incorporate into About the role? Actually "Why Kikoff" is separate paragraph about company culture; but we could drop as not required? The instruction: preserve ALL substantive information; do NOT invent or summarize away detail. So we should keep that info somewhere. Could include as a short
under About the role or as a separate section like "About Kikoff"? But headings list only given examples; we could still use
for any heading we want, but they gave examples. Probably we should include a section "About Kikoff" if we want to keep that info. However they said use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). That suggests we should stick to those headings; but we could also use other headings if needed? Safer to stick to those. The "Why Kikoff" could be considered part of "About the role" or maybe we can drop it as it's not a required heading but it's substantive. However instruction: Preserve ALL substantive information; do NOT invent or summarize away detail. So we must keep it. Could embed it in a
after the About the role heading, before responsibilities list. Thus structure:
About the role
[Why Kikoff paragraph? Actually "Why Kikoff" is separate; we could combine.] Then the paragraph about role: "Kikoff exists to help millions..." etc.] Then responsibilities: we can make a
Responsibilities
with- items extracted from the bullet-like sentences under "In This Role, You Will Drive the Pillar" etc.
Then qualifications:
Qualifications
with- items from Qualifications and Bonus Points.
Then pay:
Pay
withBase Range $268,000 - $321,000 USD We should not include Benefits or Schedule. We must output only HTML fragment, no markdown fences. Let's extract responsibilities: From text after "About The Role" paragraph: "You will drive and help shape the application security roadmap. You define the strategy, sequence the work, and drive it to done. Engineers ship fast here, and increasingly with AI agents writing code alongside them. Your job is to make that speed safe by default. In This Role, You Will Drive the Pillar Drive the application security roadmap: secure SDLC, code review, threat modeling, vulnerability management, and the pentest and bug bounty programs.Set the standard for what secure code looks like at Kikoff and build the tooling that enforces it: SAST, SCA, secrets scanning, and dependency policy wired into CI with signal engineers trust.Decide how AI-generated code gets reviewed and gated. Design the controls for a codebase where agents are contributors. Build & Secure Build paved roads into the frameworks engineers use: authn/authz libraries, input validation, safe defaults for common patterns, so the secure way is the only way most engineers encounter.Own security for our authentication and session layer: MFA design, account recovery, session management, and defenses against credential stuffing and account takeover.Secure our APIs and mobile apps: authorization models, rate limiting, abuse controls, certificate pinning, and secure storage on device.Secure the AI features we ship to customers: prompt injection defenses, tool permission boundaries, and data exposure controls for LLM-backed flows. Prove It Run the penetration testing and bug bounty programs. Triage, drive remediation, and close the loop with engineering.Build vulnerability management that holds up in front of auditors: defined SLAs, tracked remediation, and evidence that stands on its own for PCI-DSS, SOC 2, and IPO-readiness controls.Threat model new products and major features before they ship, not after. Enable Engineering Be the security engineer product engineers actually want in their design reviews. Clear answers, fast turnaround, real fixes.Stand up and run a security champions program so AppSec scales past one person.Build internal tooling, including AI-assisted review and triage, that multiplies the team's reach." We need to break into list items. Could group similar items. Let's create list items: - Drive the application security roadmap: secure SDLC, code review, threat modeling, vulnerability management, and penetration testing & bug bounty programs. - Set the standard for secure code and build tooling (SAST, SCA, secrets scanning, dependency policy) integrated into CI. - Define review and gating processes for AI-generated code; design controls for agent-contributed codebase. - Build secure frameworks: authn/authz libraries, input validation, safe defaults for common patterns. - Own security for authentication and session layer: MFA design, account recovery, session management, defenses against credential stuffing and account takeover. - Secure APIs and mobile apps: authorization models, rate limiting, abuse controls, certificate pinning, secure storage on device. - Secure AI features shipped to customers: prompt injection defenses, tool permission boundaries, data exposure controls for LLM-backed flows. - Run penetration testing and bug bounty programs; triage, drive remediation, close loop with engineering. - Build vulnerability management with defined SLAs, tracked remediation, audit-ready evidence for PCI-DSS, SOC 2, IPO-readiness. - Threat model new products and major features before they ship. - Act as security engineer in design reviews: provide clear answers, fast turnaround, real fixes. - Establish and run a security champions program to scale AppSec. - Develop internal tooling, including AI-assisted review and triage, to multiply team reach. That seems comprehensive. Qualifications: From "Qualifications" paragraph: "6+ years in security engineering with deep, hands-on application security experience: secure code review, threat modeling, vulnerability triage, and remediation at scale You write production code. Fluency in at least one of Ruby, Python, Go, or TypeScript, and comfort reading all of them You have designed and shipped authentication and authorization systems, not just reviewed them. OAuth/OIDC, session management, MFA, account recovery Hands-on with modern AppSec tooling and the judgment to know when it is wrong: SAST, SCA, DAST, secrets scanning, CI/CD integration Experience securing REST/GraphQL APIs and native mobile applications You have run or built a pentest or bug bounty program Comfortable in a fintech regulated environment: PCI-DSS, SOC 2, or similar" Bonus Points: "Bonus Points Securing LLM-backed product features or agentic workloads in production Fraud and abuse defense: bot detection, credential stuffing mitigation, device signals Security champions or developer education programs you started, not inherited Supply chain security depth: dependency provenance, artifact signing, build integrity Consumer fintech or financial services background" We can combine into qualifications list, maybe separate "Bonus Points" as optional but still qualifications. Could just include all as list items. Let's create list items: - 6+ years in security engineering with deep, hands-on application security experience: secure code review, threat modeling, vulnerability triage, and remediation at scale. - Write production code; fluency in at least one of Ruby, Python, Go, or TypeScript, and comfort reading all of them. - Designed and shipped authentication and authorization systems (OAuth/OIDC, session management, MFA, account recovery). - Hands‑on with modern AppSec tooling (SAST, SCA, DAST, secrets scanning, CI/CD integration) and judgment to know when it is wrong. - Experience securing REST/GraphQL APIs and native mobile applications. - Have run or built a penetration testing or bug bounty program. - Comfortable in a fintech regulated environment (PCI‑DSS, SOC 2, or similar). - Bonus: Experience securing LLM‑backed product features or agentic workloads in production. - Bonus: Fraud and abuse defense (bot detection, credential stuffing mitigation, device signals). - Bonus: Built security champions or developer education programs (not inherited). - Bonus: Supply chain security depth (dependency provenance, artifact signing, build integrity). - Bonus: Consumer fintech or financial services background. Pay: Base Range $268,000 - $321,000 USD. Now we need to output HTML fragment. We'll start with
About the role
then acontaining the Why Kikoff paragraph plus the role description paragraph. Why Kikoff paragraph: "This is a consumer fintech startup, and you will be working with serial entrepreneurs who have built strong consumer brands and innovative products. We value extreme ownership, clear communication, a strong sense of craftsmanship, and the desire to create lasting work and work relationships. Yes, you can build an exciting business AND have real-life real-customer impact." Then role description paragraph: "Kikoff exists to help millions of people build credit. That only works if the products they use are safe. This role helps shape the Application Security pillar at Kikoff: how code gets written, reviewed, shipped, and defended across our web, mobile, and API surfaces. You will drive and help shape the application security roadmap. You define the strategy, sequence the work, and drive it to done. Engineers ship fast here, and increasingly with AI agents writing code alongside them. Your job is to make that speed safe by default." We could combine into one
or two
. Use
for prose; we can have multiple
under the heading. Thus:
About the role
This is a consumer fintech startup, and you will be working with serial entrepreneurs who have built strong consumer brands and innovative products. We value extreme ownership, clear communication, a strong sense of craftsmanship, and the desire to create lasting work and work relationships. Yes, you can build an exciting business AND have real-life real-customer impact.
Kikoff exists to help millions of people build credit. That only works if the products they use are safe. This role helps shape the Application Security pillar at Kikoff: how code gets written, reviewed, shipped, and defended across our web,
- items from Qualifications and Bonus Points.
Then pay:
- items extracted from the bullet-like sentences under "In This Role, You Will Drive the Pillar" etc.
Then qualifications: