Remote opportunity at
Beyond FinanceSenior Application Security Engineer
Beyond Finance is a financial wellness company helping ordinary Americans get out of debt. It stresses compliance, ethics and user-friendly technology, and reports serving more than…
Career Tools
About This Role
Beyond Finance is a financial wellness company helping ordinary Americans get out of debt. It stresses compliance, ethics and user-friendly technology, and reports serving more than one million clients. The business is growing and wants a stronger application security function. This Senior Application Security Engineer runs the AppSec programme. The engineer works directly with development teams to embed secure habits, improves security tooling and automation, and advises on new features,…
Job Description
Beyond Finance is a financial wellness company helping ordinary Americans get out of debt. It stresses compliance, ethics and user-friendly technology, and reports serving more than one million clients. The business is growing and wants a stronger application security function.
This Senior Application Security Engineer runs the AppSec programme. The engineer works directly with development teams to embed secure habits, improves security tooling and automation, and advises on new features, architectures and services. The post is the main AppSec contact for teams that ship Rails web apps and React Native mobile apps, plus Python and Go services.
Tooling responsibilities include GitHub Advanced Security, Invicti for dynamic testing, Hadrian for attack surface management, AppDome for mobile protection and Cloudflare WAF, all wired into CI/CD. The engineer also writes secure development standards and training, runs reviews and triage, helps harden AWS, and follows findings to fix. The listing favours candidates who measure success by lower risk rather than closed tickets.
Responsibilities
- Set direction and run daily operations for the application security programme
- Advise on security in design, coding and review for new features
- Operate and improve static, dynamic, attack surface, mobile and WAF tools
- Build security checks into CI/CD and close control gaps
- Write secure coding standards, playbooks and training
- Run security reviews and vulnerability triage with engineers
- Harden AWS deployments across ECS, IAM and networking alongside DevOps
Requirements
- Three to seven or more years in application or product security
- Solid knowledge of secure coding, OWASP risks and modern development cycles
- Experience with cloud-native applications, ideally on AWS
- Understanding of SSL certificates and key management
- Hands-on use of SAST, DAST, WAF and mobile security tools
- Ability to shape design decisions alongside developers
- Comfort with GitHub workflows and CI/CD pipelines
Qualifications
- Rails or other dynamic-language development
- ECS or EKS, container security, secrets handling and infrastructure-as-code
- Experience building an AppSec programme from scratch
- SOAR automation and scripting
- Work in a PCI-compliant environment with yearly reporting
Core Skills
Benefits
- Employer-funded health, dental and vision programmes
- Generous time off, holiday pay and parental leave paid by the company
- 401(k) with company matching
- Advancement opportunities, career development and training
- Eligible for an annual bonus
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
What is the base salary range?
Base pay falls between USD 140,000 and 165,000 a year, and the role is bonus-eligible.
Is the role remote?
Yes. The listing is for a remote, full-time position.
Does the company accept agency candidates?
No. Unsolicited resumes from recruiters or agencies are not accepted, and no fee will be paid for them.
Which tools does the role manage?
The current tools are GitHub Advanced Security, Invicti, Hadrian, AppDome and Cloudflare WAF.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.
