Staff Application Security Engineer - Fingerprint

About Fingerprint

Fingerprint empowers enterprises to detect and stop online fraud with the world’s most accurate device intelligence. We lead our industry with bleeding-edge identification capabilities and work on turning new ideas and discoveries in the fraud detection space into reality. Our customers range from innovative startups to leading enterprise companies, including Plaid, Dropbox, and Booking.com.

Fingerprint is a globally dispersed, 100% remote company. We were named on the 2026 Forbes Best Startup Employers list and ranked #803 on the 2026 Inc. 5000 list of America’s fastest-growing private companies. We have raised $77M and are backed by Craft Ventures, Nexus Venture Partners, and Uncorrelated Ventures.

The Role in Context

Fingerprint's device intelligence platform processes billions of identification events for some of the world's most security-conscious companies. Our customers rely on us to stop attackers, making application security a core product feature. As we scale with large enterprise customers, we are establishing a focused Application Security function led by a Senior Manager, Application Security.

You will be the founding senior engineer of this function—the person who turns strategy into a working secure SDLC, finds and fixes critical issues, and raises the security bar across engineering through technical depth, tooling, and influence. This is a hands-on Staff role where you will design, build, and operate.

What You'll Do

Secure SDLC & Security Engineering

• Design and build Fingerprint's secure development lifecycle: security requirements, threat modeling at design time, secure code review, and pre-release security testing integrated into existing workflows.
• Own and operate the security tooling pipeline (SAST, DAST, SCA/dependency scanning, secrets detection, and container/IaC scanning like Snyk) tuned for signal over noise, integrated into CI/CD with clear ownership and SLAs.
• Build the pipeline AI-first with AI-assisted triage, auto-remediation, security review agents running inside coding loops and CI, and AI-augmented testing.
• Build paved-road security including secure defaults, hardened libraries/frameworks, and reusable patterns for authentication, authorization, input validation, secrets handling, and cryptography.
• Write code and contribute fixes, security libraries, CI integrations, and automation directly to engineering repositories.

Threat Modeling, Security Reviews & Vulnerability Management

• Lead threat modeling and architecture security reviews for new products, features, and major changes across APIs, SDKs (web and mobile), dashboards, and data pipelines.
• Run and mature the vulnerability management program across scanners, pen tests, bug bounties, and customer reports.
• Partner with the Compliance Lead on scoping, retesting, and turning penetration testing findings into engineering tasks.
• Perform hands-on security testing of Fingerprint's platform, including manual review and exploitation of authn/authz, API, injection, SSRF, business logic, and abuse paths.

Incident Response & Detection (Application Layer)

• Serve as the technical lead for application-layer security incidents, including investigation, containment, root cause analysis, and remediation.
• Define application security logging and alerting requirements in partnership with Cloud Platform and engineering teams.

Security Culture, Enablement & Customer Trust

• Act as an AppSec partner to engineering teams through office hours, design consultations, secure coding guidance, and a Security Champions program.
• Develop and deliver practical secure coding training grounded in Fingerprint's codebase and real findings.
• Partner with AppSec leadership to shape roadmap priorities and provide engineering evidence for compliance controls.
• Support enterprise customer security conversations, including technical questionnaires, architecture inquiries, and due diligence calls.

What We're Looking For

Required

• 8+ years of experience in software engineering and/or security engineering, with 5+ years dedicated to application security in a hands-on role at a product company.
• Strong software engineering foundation with production-quality coding ability in TypeScript/JavaScript, Go, Python, or similar languages.
• Deep practical AppSec expertise: OWASP Top 10, authn/authz design, API security, injection flaws, SSRF, cryptography misuse, and business-logic flaws.
• Proven track record leading design-time threat modeling and security reviews for complex systems.
• Experience deploying, configuring, and tuning SAST, DAST, SCA, and secrets-detection tooling in CI/CD pipelines.
• Hands-on experience with AI-native security tooling, including AI-assisted code analysis, triage, and auto-remediation.
• Experience managing vulnerability triage, risk scoring, and remediation workflows with strict SLAs.
• Strong influence without authority and ability to articulate technical risk clearly to engineers, leadership, and external customers.

Nice to Have

• Domain experience in fraud detection, bot mitigation, identity, or device intelligence.
• Cloud security depth on AWS (IAM, network boundaries, secrets management, workload identity) and familiarity with CSPM tools like Wiz.
• Knowledge of client-side and mobile SDK security (browser security models, anti-tampering, obfuscation, iOS/Android SDK hardening).
• Experience with high-volume, multi-tenant SaaS environments and latency-sensitive APIs.
• Experience operating bug bounty programs (HackerOne, Bugcrowd) or AI-augmented pen testing.
• Industry certifications (OSCP, OSWE, GWAPT, CSSLP) or security research/CVE contributions.
• Experience supporting SOC 2 / ISO 27001 controls from an engineering perspective.