Staff Application Security Engineer (R5949)
Shield AI · Remote
About the role
A staff-level individual contributor in Shield AI's Enterprise Operations Division, working remotely, who builds the company's application security programme: setting secure SDLC policy and standards, making them workable for engineers, and raising the maturity of development and software supply-chain security across product and platform teams.
The engineer assesses teams, pipelines and release processes and leads improvement roadmaps; runs SAST, DAST, SCA, secrets, IaC and container scanning with little noise; leads threat modelling and design reviews; sets vulnerability SLOs and risk acceptance rules; governs open-source use; and matures SBOMs, VEX, signing, provenance and SLSA-aligned build controls. A security champions programme, disclosure handling and executive metrics are also in scope. Shield AI wants seven or more years in AppSec, product security or DevSecOps, a record of building secure SDLC programmes across many teams, and familiarity with NIST SSDF, OWASP SAMM or SLSA.