Senior Application Security Engineer

Alloy is where you belong!

Alloy helps solve the identity risk problem for companies that offer financial products by enabling them to outpace fraud and confidently serve more people around the world. Over 600 of the world’s largest financial institutions and fintechs turn to Alloy to take control of fraud, credit, and compliance risk, and grow with the clearest picture of their customers.

Through our values: Be Bold, Get Scrappy, Collaborate, and Celebrate Our Differences, we are creating a workplace where you can grow, thrive, and belong. See how we’ve been continuously recognized and named one of Inc. Magazine’s Best Workplaces, Forbes America’s Best Startup Employers, Best Fintech to Work for by American Banker, year after year.

Check out our investors and read more about us here.

About the team

Alloy’s security team is supportive, focusing on enabling the engineers to seamlessly deliver high quality software that adheres to security best practices, instead of being gatekeepers. Security is extremely important at Alloy, so this will be a high impact role with a lot of scope for growth, leadership opportunities and learning.

What you'll be doing

Reporting into the Engineering Manager of Product Security, you will: 

• Assist in the evolution of our application security functions and services
• Implement, configure and monitor our security tools to help us detect and respond to new types of threats. Improve efficiency and reliability of these tools through scripting and automation.
• Act as a subject matter expert for security solutions
• Assist junior security engineers with their development
• Provide guidance and recommendations on application security best practices
• Maintain knowledge of the latest security trends, threats, and countermeasures
• Raise awareness about application security within Alloy
• Foster a culture of security, encourage the adoption of secure practices, and work to ensure that security is considered at every level of the organization.
• Work closely with engineering teams to secure their software throughout the entire software lifecycle from the design stage to monitoring post deployment
• Ensure that change management processes are adhered to across all platforms.
• Integrate security tools and practices into the continuous integration/continuous delivery (CI/CD) pipeline
• Automate security checks and scans to identify and fix vulnerabilities early in the development process.
• Conduct application security assessments and penetration tests to identify vulnerabilities and security issues
• Provide guidance to developers on secure coding practices.
• Collaborate with infrastructure and development teams to ensure that security measures are effectively implemented in production environments
• Be a key player of Alloy’s vulnerability management program
• Discover application security issues in our code through penetration testing, source code review, and design review.
• Analyze risk and triage issues based on severity. Communicate the issues to relevant teams with clear recommendations on how to fix them. Assist with fixing issues as needed.
• Make sure vulnerable applications or systems are being promptly updated and vulnerabilities remediated
• Report and document security findings and remediation activities
• Troubleshoot production difficulties and performance constraints with security tooling, controls, and features.
• Participate in Alloy’s bug intake and remediation process
• Stay vigilant and monitor ongoing security threats
• Analyze and respond to security incidents triggered by automated alerts, bug bounties, or external assessments
• Perform ongoing log analysis and monitoring, and set up alerts to be proactively alerted of concerning activity
• Document security incidents and the extent of the damage caused by the incidents
• Participate in incident response and handle activities related to application security incidents
• Work closely with incident response teams to mitigate the impact of a breach. This may involve coordinating with other IT professionals, communicating with stakeholders, and assisting in the recovery process.
• Investigate incidents, identifying the cause, and implementing measures to prevent similar incidents in the future.
• Partic