Senior Application Security Engineer
The Senior Application Security Engineer will own and mature the product security program, implementing secure-by-default patterns and automated vulnerability management across Starburst's distributed data platform. The role involves hands-on engineering, red-teaming, and direct engagement with enterprise customers regarding security posture.
- Compensation
- $175K–$215K / yr
- Location
- Boston, MA
- Work setup
- Not specified
- Seniority
- Senior
- Employment
- Not specified
- Experience
- 5+ years
- Category
- Security
- Posted
Skills
Must have
- Bachelor’s degree in Computer Science, Engineering, MIS, or equivalent practical experience.
- 5-7 years of experience in application security, product security, software engineering with a security focus, or a related technical role.
- Deep command of application and product security fundamentals.
- Proven experience embedding security into the SDLC.
- Demonstrated experience running vulnerability management for shipped software at scale.
- Strong knowledge of container/image security and JVM dependency and supply chain risk.
- Offensive security experience including red-teaming or threat hunting.
- Threat modeling experience on distributed systems and data platforms.
- Experience in enterprise B2B software and working directly with enterprise customers on security.
- Experience leading and mentoring engineers.
Full description
About Starburst
Starburst delivers enterprise intelligence at scale by giving organizations secure, governed access to all their data, wherever it lives. Built for distributed data environments, Starburst helps enterprises power AI and analytics without the cost and complexity of traditional data consolidation. With open standards including Trino and Apache Iceberg, Starburst enables trusted access to complete enterprise context while helping organizations avoid vendor lock-in. Leading global enterprises trust Starburst to fuel AI, analytics, and enterprise intelligence. Learn more at .
About the role
As our Senior Application Security Engineer, you'll be the technical owner of application and product security at Starburst — one person with outsized impact, backed by automation and AI rather than a large team. This is deep, hands-on engineering work: you'll build secure-by-default patterns into how our engineers design and ship, embed security controls earlier in the development lifecycle, and create the automation that lets you cover a large engineering organization. You'll get to stand up autonomous red-teaming and threat hunting against our own products, run vulnerability management across both our self-managed enterprise platform and our SaaS, and advance our software supply chain security. Because our biggest customers are global banks, you'll also be in the room with them, explaining how we secure what we ship — the kind of high-trust, high-stakes conversation that makes this work matter.
If you want to make products secure by design rather than chase what's already broken, own a program end to end, and use AI to build defensive tools, this is your opportunity. You'll work closely with Engineering, Product, and the field.
As a Senior Application Security Engineer at Starburst you will:
- Own and mature the Application Security program, moving it from established practice to measurable, automated, and scaled across a large engineering organization.
- Shift security left into the SDLC, embedding secure-by-default patterns, guardrails, threat modeling, and automated checks into design and development (including for AI-assisted development) so issues are prevented rather than found late.
- Build autonomous red-teaming and threat hunting against our own products, using AI and automation to continuously probe for weaknesses instead of relying on point-in-time testing.
- Own vulnerability management for everything we ship across our self-managed enterprise platform and SaaS product — container images, third-party dependencies, and first-party code — automating detection, triage, and routing, and advancing remediation through reachability/exploitability analysis and attack-surface reduction.