Senior Application Security Engineer

Who we are:

Sardine is the leading agentic risk platform for fighting financial crime. Our integrated solution unifies data across risk teams to help organizations stop fraud in real time, prevent AI-driven attacks, and automate fraud and AML operations. Sardine’s platform is strengthened by one of the fastest-growing fraud consortiums in the market, spanning more than 6 billion profiled devices, 800 million consumers, and 3 million businesses worldwide. Leading companies including FIS, GoDaddy, Intuit, Edward Jones, ZoomInfo, and Checkout.com rely on Sardine to secure and grow trust in their products.

Our culture:

We hire talented, self-motivated individuals with extreme ownership and high growth orientation.

We value performance and not hours worked. We believe you shouldn't have to miss your family dinner, your kid's school play, friends get-together, or doctor's appointments for the sake of adhering to an arbitrary work schedule.

We're a remote-first team spread across time zones, so no office to report to - work from wherever helps you do your best work. Just a couple of things to keep in mind: pay is based on where you're located, and you'll need to keep a home base in the country you're hired in. So while we love the "coffee shop today, mountains tomorrow" life, this isn't a passport-optional, work-from-anywhere-on-Earth kind of remote - think flexible within your country, not borderless.

Location:

Remote - United States

The role

Sardine makes risk and payment decisions for banks and fintechs. Our customers audit us closely, and application security is a large part of what they examine.

Money moves through this platform, so real adversaries study it. Your job is to find what they would find, especially authorization flaws and business logic abuse, and then make the whole class of bug go away.

The application security team is small. The estate is large: Go, Node.js, Python, Ruby, and Java services running on multi-cloud and Kubernetes. That ratio shapes the work. Findings arrive from scanners, code review, testing, threat modeling, pentesters, and bug bounty hunters. You turn that stream into a pipeline that validates, routes, and closes issues with as little manual effort as possible. Then you use what the pipeline tells you to remove root causes: secure defaults, patterns engineers reach for first, and fixes that hold.

Little here is pre-decided. You determine where the risk is and go after it.

The work

Where most of your time goes

Running and automating the vulnerability pipeline

Triage, validate, route, and drive remediation of findings from every source: SAST, DAST, SCA, code review, pentests, and bug bounty

Build the automation that removes manual effort from each of those steps

External pentests and bug bounty program: set scope, direct the testers, judge severity, and close the loop

Making bug classes go away

Spot the patterns across findings and remove the root cause, not just the instance

Set the secure patterns and defaults that make the right way the easy way

Write custom static analysis rules for our own anti-patterns, so a fixed bug class stays fixed

Review platform-layer controls (authorization, service identity, secrets handling, gateway enforcement), find the gaps, and push the owning teams until they are closed