Application Security Engineer

At MyFitnessPal, we believe good health starts with what you eat. We provide tools, resources and support to enable users to reach their health goals.

We are looking for a Security Engineer II with a focus on Application Security to join the MyFitnessPal Security team. Our users rely on MyFitnessPal to power their health and fitness journeys every day, and you will leverage your technical skills to secure the code, applications, and development processes that create the MyFitnessPal product experience. In addition to technical expertise, you'll find that your teammates value collaboration, mentorship, and inclusive environments.

About the team:

The Productivity Engineering: Automation & Self-Service (PEAS) team is responsible for the automation, CI/CD, and self-service platforms that product teams rely on to build, test, and ship features quickly and safely.

The PEAS team is part of the Technology Operations (TechOps) organization, which includes IT, Infrastructure, Security, Reliability, and DevOps/DevEx disciplines. TechOps seeks to enable MyFitnessPal to "ship with confidence" by delivering a secure, reliable, and low-friction runway to build and operate software at scale. Within TechOps, you'll represent the Security discipline — protecting the applications and development processes that keep our mobile and backend software safe for millions of users.

Essential Duties:

As a Security Engineer II, you will own the day-to-day operation of our application security vulnerability management program and act as a trusted security partner to product engineering teams. You'll triage what our tooling and researchers find, drive it to remediation, and build the automation that makes the whole program run with less manual effort. This is a hands-on technical position with real ownership and substantial opportunity for growth.

What you'll be doing:

Own day-to-day application security vulnerability management: triage findings from SAST, SCA, DAST, and mobile security tooling, assign severity and due dates, propose remediations, and drive tickets through our SVM process to resolution

Operate and grow our bug bounty program — scoping engagements, triaging researcher submissions, validating findings, and coordinating with vendors

Leverage AI and agentic tooling (for example, Claude Code and agentic pipelines) to accelerate security workflows — from vulnerability triage and enrichment to automated remediation support — and help ensure our AI-assisted development practices remain secure

Build and maintain security automation (for example, in our SOAR platform and with Python) that normalizes vulnerability intake, drives notifications and SLAs, and produces the metrics and reporting that keep the program transparent

Partner with product engineering teams on remediation — joining triage and refinement discussions, answering questions, and representing security as a business enabler rather than a blocker

Perform security reviews of new features, services, and third-party integrations, providing pragmatic, risk-based guidance

Advocate secure coding practices and contribute to developer-facing security documentation and training

Administer and tune application security tooling across the SDLC, and help evaluate and implement new security technology

Support identity and access management workflows and the automation behind them

Qualifications to be successful in this role:

2-4 years of experience in security engineering, application security, software engineering, or a closely related role

Understanding of application security assessment techniques (e.g., SAST, DAST, SCA, penetration testing) and the steps to remediate findings

Knowledge of secure development practices for web and mobile applications (e.g., OWASP Top 10, OWASP MASVS)

Experience working with AI/agentic-assisted tooling (e.g., Claude Code or similar AI coding assistants, LLM-powered workflows, or agentic automation) and enthusiasm for applying it to security work

Experience performing security triage, investigation, and vulnerability management, including communicating findings and remediation guidance to engineers

Familiarity with auto-scaling cloud microservices and associated technologies (e.g., containerization, Kubernetes, infrastructure as code)