Senior Application Security Engineer II

About the role

Relay is a digital‑banking platform that equips self‑made business owners with tools to manage money confidently. The team is moving away from a traditional advisory AppSec model, and we need a Senior Application Security Engineer II who thrives on autonomy, curiosity, and impact. You will work across the full stack—from TypeScript and Node.js to PostgreSQL and AWS cloud infrastructure—to secure applications from design through deployment.

Key responsibilities

• Threat model technical design documents and conduct white‑box penetration tests to uncover vulnerabilities.
• Tri­age bug‑bounty and VDP reports, reproduce issues, coordinate fixes, and communicate durable controls.
• Contribute patches directly to Relay’s code base when appropriate.
• Extend and maintain security tooling such as Datadog security, secrets scanning, logging, Burp Suite, and custom in‑house tools.
• Leverage AI tools like Claude and Cursor as default components of the development workflow.
• Participate in regular team rhythms, including stand‑ups, security‑champion sessions, and Hack‑The‑Box exercises.
• Enforce software‑supply‑chain safeguards: SBOM on every build, dependency pinning, private registries, and runtime SCA detection.

Required profile

• 5‑6 years of professional security experience in application security, penetration testing, or product security engineering.
• Proven track record of shipping production‑level code and the ability to navigate unfamiliar codebases.
• Deep understanding of OWASP Top 10 and real‑world exploitation and mitigation techniques.
• Hands‑on experience building with AI tools and awareness of their limitations.
• Clear communicator who partners effectively with developers.
• Strong sense of ownership and ability to keep stakeholders informed.
• Comfortable mentoring teammates and cross‑functional engineers on security best practices.

Required skills

• TypeScript
• Node.js
• PostgreSQL
• AWS cloud services
• Datadog security monitoring
• Burp Suite
• Claude (AI)
• Cursor (AI)
• Software Bill of Materials (SBOM)
• Software Composition Analysis (SCA)