Application Security Engineer
Posted Updated
- Glean is looking for an experienced Application Security Engineer with a primary focus on ensuring that our entire technology stack is free of software vulnerabilities (CVEs). This role is responsible for securing our base OS images, ensuring all open-source software (OSS) dependencies are scanned and patched, and integrating cutting-edge security tools into our CI/CD pipeline
- This role will lead the vulnerability management charter at Glean, identifying, evaluating, and implementing new security technologies and processes to proactively protect our infrastructure
- Own the vulnerability management lifecycle across Glean’s technology stack, from discovery and prioritization through remediation, reporting, and measurement
- Harden base OS images and secure open-source dependencies, package managers, and the broader software supply chain
- Integrate SAST, DAST, dependency scanning, and automated security validation into CI/CD pipelines
- Evaluate, adopt, and develop security solutions and tooling, including Google’s Assured OSS and comparable approaches
- Define secure-coding practices and drive engineering adoption through guidance, training, and mentorship
- The ideal candidate will drive the adoption of solutions like Google’s Assured Open Source Software (OSS) and explore alternative approaches to enhance software security
- Deep understanding of software security vulnerabilities, including CVEs, OWASP Top 10, and supply chain risks
- Experience with SAST, DAST, dependency scanning, and vulnerability management tools (e.g., Snyk, GitHub Dependabot, Trivy, Clair, Burp Suite, OWASP ZAP)
- BA/BS in Computer Science, Cybersecurity, or a related field (or equivalent industry experience)
- Ability to lead cross-functional initiatives and drive security adoption across engineering teams
- Proactive, pragmatic, and collaborative, with strong problem-solving skills and the ability to balance security with performance and usability
- Hands-on experience with cloud-native security across AWS, GCP, including containers, Kubernetes, and microservices
- 8+ years of experience in application security and vulnerability management