Staff Application Security Engineer

Responsibilities

• AppSec strategy, standards, and influence
• Lead Apollo’s multi-year AppSec strategy and turn it into multi-quarter, cross-team initiatives that move Security department KRs. Report progress, risks, and tradeoffs to Security leadership on a regular cadence.
• Shape Engineering, Product, Platform, and Data roadmaps so security work is planned in early, and represent AppSec in cross-department decisions.
• Set the secure design, code review, and risk model standards used across the department and adjacent engineering teams, including expectations for AI-generated and agent-generated code.
• Mentor senior engineers and security champions, grow the champions program, and help raise the hiring bar, so the AppSec program does not depend on one person’s expertise.
• Secure architecture and vulnerability depth
• Lead security architecture reviews and threat modeling for ambiguous, high-scale, multi-team systems, including AI and agent features, and define the approach where no precedent exists.
• Design and drive adoption of secure-by-default building blocks, such as shared authorization, safe OAuth and token handling, and SSRF-safe HTTP clients, so whole classes of issues stop appearing.
• Shape vulnerability management across internal reviews, bug bounty, pentests, and SCA and runtime findings, with a focus on root causes, bug classes, and clear risk-based severity decisions.
• Stay hands-on for the hardest cases: read code across teams, develop exploits, test bypasses, and lead variant analysis and staged remediation across teams.

Languages