Note: The job is a remote job and is open to candidates in USA. ButterflyMX is on a mission to empower people to open and manage doors & gates from a smartphone. They are seeking a Senior Security Engineer to drive application security across the software development lifecycle, focusing on threat modeling, secure code review, and vulnerability management.
Responsibilities
- Lead application security reviews, threat modeling sessions, and secure code review for new features and significant product changes
- Operate and continuously improve SAST, DAST, and SCA tooling; triage and prioritize findings in partnership with engineering teams to harden the codebase
- Plan and execute internal penetration tests against web applications, APIs, and mobile clients; coordinate and support third-party assessments
- Own the vulnerability management lifecycle from discovery, prioritization, remediation tracking, through to validation
- Develop and maintain secure coding standards, developer security guidance, and training materials
- Integrate security tooling into CI/CD pipelines and champion shift-left security practices across the SDLC
- Investigate security incidents and bug bounty submissions; provide root cause analysis and remediation recommendations
- Partner with Product and Engineering on security architecture decisions for new product capabilities
- Stay current on emerging threats, CVEs, and attack techniques relevant to our technology stack and support continuous program improvement
Skills
- 5+ years of experience in application security, with hands-on proficiency in both secure development lifecycle practices and offensive testing
- Strong understanding of web application and API security fundamentals (OWASP, MITRE, CIS, API-specific attack surfaces)
- Experience operating SAST/DAST/SCA ASPM tools
- Fluency in scripting or development languages (Python, JavaScript, Go, Ruby, or similar) sufficient to review code and write internal tooling
- Experience designing and executing penetration tests against modern web and mobile applications
- Familiarity with cloud security (AWS preferred, some GCP and OVH) and container/Kubernetes security
- Comfortable in a regulated environment (e.g., SOC 2 or similar)
- Excellent written and verbal communication skills; able to translate technical risk to non-technical stakeholders
- Proven experience with leveraging AI tools in both professional and personal settings. ButterflyMX is an AI-forward organization and the ability to optimize efficiency using AI is crucial in every role. Can you use LLMs to build a threat model (bootstrap from the code, docs, and vulnerability history, entry points, git history, etc. and leverage Shostack's four questions); to build an isolation layer to run agents safely and verify exploitability matched to the threat model; to partition the search space and leverage SAST scanners or fuzzers; to filter out non-exploitable findings and triage for patch priority; and, to rate the severity based on reachability, attacker control, preconditions, authentication, read vs write, and blast radius
- Relevant certifications a plus: OSCP, GWAPT, GPEN, CEH, or equivalent
Benefits
- Comprehensive Medical, Dental and Vision plans (ButterflyMX covers 80% of the cost) starting day 1
- 401(k) plan with a match
- 10 paid holidays, 20 vacation days, 5 sick days, 3 floating holidays
- Basic Life and Accidental Death and Dismemberment Insurance (ButterflyMX covers 100% of the cost)
- Short and Long Term Disability (ButterflyMX covers 100% of the cost)
- Paid Family Leave
- Employee Assistance Program
- Quarterly self-care stipends
- Access to optional benefits including pre-tax flexible healthcare spending accounts (FSA and HSA), Dependent Care FSA, and Commuter Benefits, as well as optional Supplemental Life, AD&D, Hospital Indemnity, Legal, Accident, Critical Illness, Pet, and Personal Liability Insurance
Company Overview