Application Security Engineer

Very Good Security · United States

Junior
Full-time
$175,000 – $230,000
Posted 2026-10-12
Confirmed live on 10 November 2026

Job description

<div>
<h2 style="margin-top: 18pt; margin-bottom: 6pt;">About VGS</h2>
VGS is building the trust infrastructure for a new era of commerce. As commerce becomes agentic, payments are increasing dramatically in volume, speed, and complexity, and the companies driving that shift need a foundation they can fully trust. 
That's where VGS comes in. We're the world's leader in payment tokenization, trusted by the most innovative AI and Fortune 500 companies, merchants, banks, and fintechs to power modern payments and agentic commerce. We store more than 9 billion tokens and process more than 10 billion monthly interactions, touching a third of all e-commerce. That scale isn't incidental. It's why leading companies embed our universal token vault and credential management platform directly into their stack, taming the complexity of payment data so they can move faster. 
Come build the platform that enables modern payments for the world's largest companies. We're helping businesses unlock new possibilities in an industry that never stops moving. And that takes exceptional people.
 
<hr>
 
<h2 style="margin-top: 18pt; margin-bottom: 6pt;">About the Role</h2>
As an Application Security Engineer, you will partner directly across Security and Engineering to build a friction-free, developer-centric security program. You will shape our Secure SDLC, automate security guardrails in our CI/CD pipelines, scale our private bug bounty program, and foster a strong culture of security champions across a globally distributed team.
 
<ul style="margin-top: 0px; margin-bottom: 0px; padding-inline-start: 48px;">
<li style="font-size: 11pt; font-family: Arial, sans-serif; margin-left: -6pt;">
Automate Security Controls: Integrate proactive security tooling (SAST, DAST, SCA) directly into CI/CD pipelines (GitHub/GitLab) to catch vulnerabilities before code hits production.
</li>
<li style="font-size: 11pt; font-family: Arial, sans-serif; margin-left: -6pt;">
Define & Drive Secure SDLC: Design, communicate, and maintain developer-friendly SDLC processes, frameworks, and threat modeling practices (e.g., STRIDE).
</li>
<li style="font-size: 11pt; font-family: Arial, sans-serif; margin-left: -6pt;">
Manage Bug Bounty & Triage: Spearhead our private bug bounty program—tracking spends, triaging reports, and lowering Mean Time to Mitigation (MTTM).
</li>
<li style="font-size: 11pt; font-family: Arial, sans-serif; margin-left: -6pt;">
Build Engineering Capability: Share best practices through secure coding training and cultivate a Security Champions network across Engineering.
</li>
<li style="font-size: 11pt; font-family: Arial, sans-serif; margin-left: -6pt;">
Lead AppSec Reviews: Conduct threat models and code reviews for Java and Python microservices.
</li>
<li style="font-size: 11pt; font-family: Arial, sans-serif; margin-left: -6pt;">
Amplify Security Culture: Partner with external communications to author technical blogs, manage vulnerability disclosures, and showcase VGS’s security engineering.<span sty

Prepare for the interview

Nothing collected for this employer yet. The Blind 75 is what technical screens draw from; practice it here, with a coach, in Java or Python.

More at Very Good Security

Sr. Solutions Architect · United States
Sr. Software Engineer - DevEx · United States
Sr. Accountant · United States
Sr. Partnerships Manager · United States
Solutions Architect · United Kingdom

Job description

Prepare for the interview

More at Very Good Security

More like this