Sr. Application Security Engineer

• Please note that this is a HYBRID role, requiring this person to work at our Cottonwood Heights office in SLC two days a week. We are not able to provide work sponsorship (i.e. OPT, STEM-OPT or H-1B visa) for this role *

As a Sr. Application Security Engineer at Extra Space, you'll be a trusted security partner embedded in how our engineering teams design, build, and ship software. You'll work across our Product Engineering org alongside principal and staff engineers, the cybersecurity team, and a security champion on every engineering team, building security in from the start. Our applications run on AWS and Vercel. They're built mostly with C# .NET, TypeScript, and React/Next.js, backed by SQL Server and other relational and non-relational databases.

Duties & Responsibilities

• Conduct security architecture and design reviews for new and evolving features, surfacing risk early and recommending practical mitigations.
• Perform threat modeling and manual and automated code reviews, and partner with developers to prioritize and remediate what you find.
• Drive a risk-based approach to application security, helping teams understand vulnerabilities in terms of business impact.
• Mature our Secure SDLC, including secure coding standards, security requirements, and automated checks (SAST, DAST, SCA, secrets scanning) in our CI/CD pipelines.
• Build and maintain security tooling and automation that scales across teams, with a focus on reducing risk rather than adding tools.
• Lead and grow the security champions program, training champions so each team has security expertise close at hand.
• Serve as the application security subject matter expert for engineering, product, and leadership, and mentor engineers on secure development practices.
• Make sure AI tools and AI-powered features are adopted within acceptable risk limits.
• Align our applications with SOC 1, SOX, CIS v8, and PCI DSS (SAQ-A, SAQ-P2PE), and support audits with evidence and remediation plans.

Requirements

• 6+ years of combined experience in software engineering, application security, product security, or a closely related field.
• Proficiency in most of our primary languages (C# .NET, TypeScript, JavaScript, SQL).
• Experience securing web applications built on modern frameworks and cloud-native architectures, particularly AWS.
• Hands-on white-box testing and secure code review experience.
• Strong understanding of SSDLC principles and experience implementing or maturing secure development programs.
• Solid understanding of common vulnerabilities and attack techniques (OWASP Top 10, API security, authentication and authorization flaws).
• Experience integrating security tooling into delivery pipelines (GitHub, TeamCity, or similar).