[All remote jobs](https://jobicy.com/jobs.md)[![Apollo.io logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2022/01/f3c639242c4d1f4cb9c0730ac3842a72.jpeg)](https://jobicy.com/company/apollo-io.md)[Apollo.io](https://jobicy.com/company/apollo-io.md) # Senior Application Security Engineer AI Summary Apollo.io is seeking a senior individual contributor to own and improve application security across its SaaS platform and AI-powered features. The role covers secure SDLC practices, architecture and code reviews, threat modeling, vulnerability triage, offensive validation, and remediation support. The engineer will configure AppSec tooling, automate operational workflows, and develop security controls for AI APIs, prompts, responses, and data-exfiltration risks. Success requires strong software engineering depth, practical penetration-testing skills, and the ability to influence engineering, product, platform, data, and legal partners. The position is US-remote and operates at an L6 level with responsibility for long-horizon goals and ambiguous cross-functional problems.[Apply for this job](#job-application)[View company](https://jobicy.com/company/apollo-io.md)ShareRemote from[USA](https://jobicy.com/job-region/usa.md)SalaryUSD 190,100–273,200 / yrDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceSeniorPublished14 Nov 2026Apply before14 Dec 2026Listing views42Application actions4Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. Opportunity details ## About this role. [Apollo.io](https://jobicy.com/company/apollo-io.md) is the leading go-to-market solution for revenue teams, trusted by over 500,000 companies and millions of users globally, from rapidly growing startups to some of the world’s largest enterprises. Founded in 2015, the company is one of the fastest growing companies in SaaS, raising approximately $250 million to date and valued at $1.6 billion. [Apollo.io](http://apollo.io/) provides sales and marketing teams with easy access to verified contact data for over 210 million B2B contacts and 35 million companies worldwide, along with tools to engage and convert these contacts in one unified platform. By helping revenue professionals find the most accurate contact information and automating the outreach process, [Apollo.io](http://apollo.io/) turns prospects into customers. Apollo raised a series D in 2023 and is backed by top-tier investors, including Sequoia Capital, Bain Capital Ventures, and more, and counts the former President and COO of Hubspot, JD Sherman, among its board members. ### Role Overview The Senior Application Security Engineer is a senior individual contributor responsible for strengthening Apollo’s secure software development lifecycle and reducing application risk across product, platform, and AI-powered features. This role blends deep code-level application security work with strong cross-functional partnership. It includes application security reviews, threat modeling, AppSec tooling, findings triage and remediation follow-through, external testing intake, and developer enablement. This role is calibrated at the L6 senior-IC level: owning semi-annual or annual goals, solving ambiguous problems with sound judgment, improving operational processes, and driving meaningful cross-team collaboration and influence. ### Key Responsibilities ### Secure SDLC, design review, and threat modeling * Own and continuously improve the secure software development lifecycle for Apollo applications so security is embedded into design, implementation, and deployment. * Perform application security reviews, threat modeling, and deep code-level analysis for high-impact product, platform, and AI features before launch. * Provide practical security architecture guidance to Engineering, Product, and IT teams * Help define and maintain application-security guardrails, secure design expectations, code review standards, and risk models for new and existing systems. ### Vulnerability management and hands-on remediation * Drive execution-heavy vulnerability management across internal reviews, bug bounty, pentests, SCA/runtime findings, and other research signals, ensuring findings are validated, prioritized, routed clearly, and tracked through remediation and verification within SLAs. * Go beyond identifying issues: read the code, explain root cause, propose the safest fix, and directly implement or support remediation when needed for complex vulnerabilities. * Perform hands-on validation and offensive security testing of applications and fixes, including exploit development, bypass testing, adversarial thinking, and focused red-team-style exercises, to confirm remediations address the underlying issue rather than only the initial symptom. * Work across the kinds of application security issues common in modern SaaS environments, including authentication and authorization weaknesses, access control risks, OAuth and CSRF design flaws, SSRF, cryptographic and verification issues, information disclosure and data exposure risks, unsafe execution and deserialization patterns, and dependency or runtime vulnerabilities. * Apply clear, risk-based severity decisions using exploitability, data sensitivity, customer impact, and blast radius ### Tooling, automation, and AI * Configure and improve AppSec tooling and integrations, including SAST configuration, ignore lists, dashboards, and other controls that maintain useful coverage without excessive noise. * Select, build, or refine security tooling, small automations, and workflow enrichments that reduce manual effort and scale AppSec operations responsibly. * Use AI to automate, transform, and scale security and engineering-adjacent processes where it materially improves speed, consistency, or signal quality, while still validating outputs with strong engineering judgment. * Embed AI-specific security checks into SSDLC reviews and code analysis, including input and output handling, AI-exposed APIs, prompt and response guardrails, and abuse or data-exfiltration paths. * Partner cross-functionally on AI security requirements and controls so AI systems and AI-powered features are designed, deployed, and operated securely. ### Engineering enablement and partnership * Support and scale security enablement for engineers and security champions, including secure coding, AppSec, and AI-safety content. * Provide actionable remediation guidance, secure patterns, and examples that help engineering teams fix issues quickly and correctly. * Partner closely with Engineering, Product, Platform, Data, Legal, and other security teams to keep AppSec priorities aligned with business risk and product velocity. * Produce clear documentation, metrics, and written narratives that improve AppSec visibility, observability, and decision-making. ### What Good Looks Like * Owns meaningful AppSec goals over a semi-annual or annual horizon and independently identifies the right solutions to ambiguous, open-ended problems. * Drives cross-team collaboration and operational improvements beyond isolated tickets or one-off reviews * Makes informed decisions by balancing technical detail, business context, customer trust, and long-term risk * Sets a high bar for ownership, communication, mentoring, and technical judgment, and helps raise the effectiveness of peers and partner teams. ### Required Skills & Experience * 5+ years of software engineering or application security experience, with meaningful hands-on AppSec depth in modern SaaS environments. * Strong software development skills and the ability to read, write, and ship production code; Ruby experience is highly valuable, and Python or similar scripting ability is a plus. * Strong Linux and cloud fundamentals, ideally with experience in GCP-backed environments. * Deep familiarity with common AppSec issues, secure design, secure authentication and authorization patterns, vulnerability management, and developer security tooling. * Demonstrated ability to perform deep code review, penetration testing, and exploit-oriented validation, and to either fix vulnerabilities directly or work closely with engineers to land durable remediations that hold up against bypass attempts and variant analysis. * Experience handling findings from bug bounty, pentests, internal reviews, or automated security tooling through closure and verification. * Experience using AI-assisted tools, automations, APIs, or structured workflows to improve engineering or security processes at scale. * Experience securing AI-powered systems or features, including AI API exposure, prompt and response handling, data protection, misuse scenarios, and monitoring expectations. * Strong written and verbal communication, stakeholder management, and influencing skills across technical and non-technical partners. ### Preferred Qualifications * Experience supporting or leading security reviews for AI-native products, internal agents, or AI-assisted engineering workflows. * Experience improving secure-by-design practices and AppSec observability in a fast-moving engineering organization * Experience with security training, developer enablement, or security champions programs * Relevant security certifications are a plus ### Example Success Outcomes * Improve the health and flow of AppSec findings by keeping prioritization, remediation, and verification moving within defined SLAs. * Complete recurring application reviews or threat models for important systems and features * Increase engineering adoption of secure patterns, AppSec tooling, and security training * Reduce manual toil and improve AppSec signal quality through targeted automation and responsible use of AI-assisted workflows. The listed Pay Range reflects the total cash compensation inclusive of annual base salary and annual bonus as applicable. For sales roles, the range provided is the role’s On Target Earnings (“OTE”) range, meaning that the range includes both the sales commissions/sales bonus target and annual base salary for the role. This salary range may be inclusive of several career levels at Apollo and will be narrowed during the interview process based on a number of factors, including the candidate’s experience, qualifications, and location. Applicants interested in this role who are not located in the US may request the annual salary range for their location during the interview process. Additional benefits for this role may include: equity; company bonus or sales commissions/bonuses; 401(k) plan; at least 10 paid holidays per year, flex PTO, and parental leave; employee assistance program and wellbeing benefits; global travel coverage; life/AD&D/STD/LTD insurance; FSA/HSA and medical, dental, and vision benefits. Tier 1 Pay Range (San Francisco, New York City, Seattle) $218,600—$273,200 USD Tier 2 Pay Range (All other US Locations) $190,100—$237,600 USD ### We are AI Native Apollo.io is an AI-native company built on a culture of continuous improvement. We’re on the front lines of driving productivity for our customers—and we expect the same mindset from our team. If you’re energized by finding smarter, faster ways to get things done using AI and automation, you’ll thrive here. ### Why You’ll Love Working at Apollo At Apollo, we’re driven by a shared mission: to help our customers unlock their full revenue potential. That’s why we take extreme ownership of our work, move with focus and urgency, and learn voraciously to stay ahead. We invest deeply in your growth, ensuring you have the resources, support, and autonomy to own your role and make a real impact. Collaboration is at our core—we’re all for one, meaning you’ll have a team across departments ready to help you succeed. We encourage bold ideas and courageous action, giving you the freedom to experiment, take smart risks, and drive big wins. If you’re looking for a place where your work matters, where you can push boundaries, and where your career can thrive—Apollo is the place for you. Learn more [here!](https://www.apollo.io/we-are-apollo) Show more [Apply now >](https://jobicy.com/jobs/162120-senior-application-security-engineer-4.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 5/5RelaxedFast-paced ### Autonomy Level 5/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThis is a highly senior AppSec role requiring hands-on code analysis, exploit validation, secure architecture judgment, and ownership of organization-wide security processes. The engineer must independently resolve ambiguous, high-impact risks while influencing multiple technical and business teams. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Market rate$231,650US market range (per year)$190k–$275k0$302.50k AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. The employer explicitly states that the published figures are annual total cash compensation, including annual base salary and applicable annual bonus. The disclosed US range spans $190,100 to $273,200 per year depending on location tier; the midpoint across the full disclosed range is $231,650 annually. A reasonable estimated US market range for a senior application security engineer with AI-security responsibilities is $190,000 to $275,000 in annual total cash compensation. ## Core skills Skills and capabilities most closely associated with this opportunity. [Application Security](https://jobicy.com/jobs?search_keywords=Application%20Security.md)[Secure SDLC](https://jobicy.com/jobs?search_keywords=Secure%20SDLC.md)[Threat Modeling](https://jobicy.com/jobs?search_keywords=Threat%20Modeling.md)[Secure Code Review](https://jobicy.com/jobs?search_keywords=Secure%20Code%20Review.md)[Penetration Testing](https://jobicy.com/jobs?search_keywords=Penetration%20Testing.md)[Vulnerability Management](https://jobicy.com/jobs?search_keywords=Vulnerability%20Management.md)[Exploit Development](https://jobicy.com/jobs?search_keywords=Exploit%20Development.md)[SAST](https://jobicy.com/jobs?search_keywords=SAST.md)[OAuth Security](https://jobicy.com/jobs?search_keywords=OAuth%20Security.md)[Cloud Security](https://jobicy.com/jobs?search_keywords=Cloud%20Security.md)[GCP](https://jobicy.com/jobs?search_keywords=GCP.md)[Ruby](https://jobicy.com/jobs?search_keywords=Ruby.md)[Python](https://jobicy.com/jobs?search_keywords=Python.md)[AI Security](https://jobicy.com/jobs?search_keywords=AI%20Security.md)[Security Automation](https://jobicy.com/jobs?search_keywords=Security%20Automation.md) Sample interview questionsHow would you improve a secure SDLC in a rapidly evolving SaaS organization?I would first map the current engineering lifecycle and identify where security controls provide the highest risk reduction with the least friction. I would introduce lightweight design reviews and threat modeling for high-impact changes, integrate actionable automated checks into CI/CD, define clear severity and remediation SLAs, and measure adoption and closure quality. Regular feedback from developers would guide iterative improvements to keep the program practical. Describe your approach to validating that a security fix addresses the root cause rather than only the reported symptom. I begin by reproducing the original issue and tracing the relevant code and trust boundaries to understand the root cause. After reviewing the proposed fix, I test bypasses, alternate inputs, adjacent endpoints, and variants of the vulnerability class. I also assess whether the remediation introduces regressions or leaves related components exposed, then document validation evidence before closing the finding. How would you prioritize findings from bug bounty reports, penetration tests, and automated scanners? I would validate the finding first, then prioritize it using exploitability, exposed attack surface, data sensitivity, customer impact, blast radius, and the presence of compensating controls. Automated findings require careful deduplication and false-positive reduction, while credible externally reported vulnerabilities may need expedited handling. Each accepted finding should have a clear owner, target SLA, remediation guidance, and verification plan. What security concerns would you evaluate for an AI-powered product feature? I would assess data flows, model and API permissions, prompt and response handling, tenant isolation, sensitive-data exposure, prompt injection, indirect prompt injection, tool authorization, output validation, logging, abuse paths, and monitoring. I would also confirm that AI agents have least-privilege access and that external content cannot silently cause unsafe actions. Controls should be tested through realistic adversarial scenarios before release. How do you influence engineering teams to adopt secure coding practices without becoming a delivery bottleneck? I focus on providing clear, contextual guidance that helps teams make secure choices early. This includes reusable secure patterns, concise threat-modeling templates, well-tuned tooling, developer-friendly remediation examples, and office hours for complex decisions. I use metrics and recurring feedback to demonstrate where security processes reduce rework and operational risk, rather than presenting security as an external gate. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![GitLab logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/12/WRILS-201207055737-109952.jpg) GitLab Nov 14 New ### [Threat Research Engineer, Security Factory: Threat Research](https://jobicy.com/jobs/162093-threat-research-engineer-security-factory-threat-research.md) GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50… * ![Beyond Finance logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2022/01/68cd015e123539d873279c7b82f1ca6a.jpg) Beyond Finance Nov 14 New ### [Staff Security Engineer](https://jobicy.com/jobs/155261-staff-security-engineer.md) At Beyond Finance, we’ve made it our mission to help everyday Americans escape the endless cycle of crippling debt and step into a brighter financial future. Through compassionate, individualized care,… * ![Sporty Group logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/8e6c246a-221.png) Sporty Group Nov 14 New ### [Offensive Security Engineer](https://jobicy.com/jobs/149060-offensive-security-engineer.md) About the roleMission Strengthen Sporty’s offensive security posture by proactively testing and identifying vulnerabilities across our external perimeter, standalone virtual private servers (VPS), physical office infrastructure, and endpoint defenses. The… * ![Liftoff logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/c47aea9f-221.png) Liftoff Nov 14 New ### [Security Engineer, Detection & Response](https://jobicy.com/jobs/153102-security-engineer-detection-response.md) Liftoff is a leading AI-powered performance marketing platform for the mobile app economy. Our end-to-end technology stack helps app marketers acquire and retain high-value users, while enabling publishers to maximize… * ![ANGI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/09/50cccf084c34089de2274f72e18841d0.jpg) ANGI Nov 13 New ### [Senior Security Engineer, Detection & Response](https://jobicy.com/jobs/161962-senior-security-engineer-detection-response.md) For over 30 years, Angi has powered the future of the home services industry, creating an environment where homeowners and pros benefit from more jobs done well. For homeowners, our… * ![ANGI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/09/50cccf084c34089de2274f72e18841d0.jpg) ANGI Nov 13 New ### [Senior Security Engineer, Application Security](https://jobicy.com/jobs/161957-senior-security-engineer-application-security.md) For over 30 years, Angi has powered the future of the home services industry, creating an environment where homeowners and pros benefit from more jobs done well. For homeowners, our… * ![Domino Data Lab logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/11/2b7332248704-221.webp) Domino Data Lab Nov 13 New ### [Staff Software Engineer, Identity and Authorization](https://jobicy.com/jobs/161940-staff-software-engineer-identity-and-authorization.md) Who we are At Domino, we build solutions that help the largest, highly regulated organizations adopt AI to accelerate mission-critical use cases. Our platform integrates a streamlined model and app… * ![Domino Data Lab logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/11/2b7332248704-221.webp) Domino Data Lab Nov 13 New ### [Senior Software Engineer, Patch Engineering & Vulnerability Remediation](https://jobicy.com/jobs/161935-senior-software-engineer-patch-engineering-vulnerability-remediation.md) Who we are At Domino, we build solutions that help the largest, highly regulated organizations adopt AI to accelerate mission-critical use cases. Our platform integrates a streamlined model and app… * ![Rackner logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/11/05f1f6baeea0-221.webp) Rackner Nov 13 New ### [Application Security Engineer — Secure Mission Systems](https://jobicy.com/jobs/161922-application-security-engineer-secure-mission-systems.md) Application Security Engineer — Secure Mission Systems Location: Mainly remote, with onsite work in Laurel, Maryland, typically one day approximately every six weeks for team-wide sprint planningClearance: Active final DoD… * ![TRM Labs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/34aa038c-221.png) TRM Labs Nov 13 New ### [Global Investigator – National Security](https://jobicy.com/jobs/161913-global-investigator-national-security.md) Build a Safer World. TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM’s platforms enable investigators to trace illicit activity, build… [Browse all jobs](https://jobicy.com/jobs.md)