Senior Application Security Engineer

Who we are

Sardine is the leading agentic risk platform for fighting financial crime. Our integrated solution unifies data across risk teams to help organizations stop fraud in real time, prevent AI-driven attacks, and automate fraud and AML operations.

The Role

Sardine makes risk and payment decisions for banks and fintechs. Our customers audit us closely, and application security is a large part of what they examine.

Money moves through this platform, so real adversaries study it. Your job is to find what they would find, especially authorization flaws and business logic abuse, and then make the whole class of bug go away.

The application security team is small. The estate is large: Go, Node.js, Python, Ruby, and Java services running on multi-cloud and Kubernetes. Findings arrive from scanners, code review, testing, threat modeling, pentesters, and bug bounty hunters. You turn that stream into a pipeline that validates, routes, and closes issues with as little manual effort as possible, removing root causes.

Responsibilities

Running and Automating the Vulnerability Pipeline

• Triage, validate, route, and drive remediation of findings from every source: SAST, DAST, SCA, code review, pentests, and bug bounty
• Build the automation that removes manual effort from each of those steps
• External pentests and bug bounty program: set scope, direct the testers, judge severity, and close the loop

Making Bug Classes Go Away

• Spot patterns across findings and remove root causes, not just instances
• Set secure patterns and defaults that make the right way the easy way
• Write custom static analysis rules for anti-patterns
• Review platform-layer controls (authorization, service identity, secrets handling, gateway enforcement), find gaps, and push owning teams until closed
• Work alongside engineers on simple, adoptable, and durable fixes

Additional Responsibilities

• Hands-on testing of applications and APIs, and manual code review of high-exposure services (depth in authorization and business logic)
• Threat modeling on new and high-exposure designs
• Security enablement across engineering, including a security champions program

What We're Looking For

• Automated vulnerability management: Experience running vulnerability management end to end, automating with code against scanner, ticketing, and source-control APIs
• Engineering background: Shipped and maintained real software; ability to read unfamiliar code quickly and reason about architecture and failure modes
• Ownership to done: Taking problems all the way through, including cross-team fixes
• Judgment over tenure: Strong depth of judgment
• Code auditing in at least one of Go, Python, Node.js, Ruby, or Java, and willingness to work across the others
• Practical command of OWASP Top 10, with real depth in broken access control and business logic flaws
• SAST, DAST, and SCA in CI/CD
• Cloud fundamentals on GCP or AWS
• Docker and Kubernetes
• Pragmatic approach to real versus theoretical findings
• Strong asynchronous influence and evidence-based collaboration

Bonus Qualifications

• Scaling security tooling across many repositories, languages, and build systems
• Prior experience writing custom static analysis rules (Semgrep, CodeQL, or similar)
• Fintech, payments, or environments under third-party security review (PCI DSS, SOC 2, customer audits)
• Fully distributed, asynchronous engineering experience
• Offensive experience (web, API, mobile, cloud pentesting, hardware, red team, CTF, bug bounty)
• Advanced offensive certifications (OSWE, BSCP, CPTS, CRTO, etc.)
• Public work: research, tooling, disclosures, talks