Application Security Engineer

At Qodo, we're building an AI Code Review platform that helps developers move fast, ship with confidence, and elevate code quality across the SDLC through deep, scalable codebase understanding.

We're seeking an Application Security Engineer to join our team. This role is ideal for someone who can collaborate closely with developers, provide practical security guidance, and also dive deep into our codebase and cloud infrastructure to ensure our product is secure by design. This is a hands-on role with strong influence across engineering.

Responsibilities

• Shape and execute Qodo’s approach to application and cloud security, focusing on practical, developer-first solutions rather than high-level governance.
• Partner with engineering teams to embed secure-by-default practices into the SDLC, including secure code reviews, threat modeling, SAST/DAST usage, and GenAI guardrail implementations.
• Perform hands-on security work: reviewing code, improving cloud configurations, hardening services, and implementing security tools and automation.
• Collaborate with DevOps to integrate security controls into CI/CD pipelines, containerized environments, and infrastructure-as-code.
• Conduct security assessments, analyze vulnerabilities, and provide actionable remediation to developers.
• Develop and maintain internal security standards and playbooks; support incident response when needed.

Requirements

• 4+ years of experience in application security engineering, with a strong focus on both cloud security and secure software development.
• Hands-on experience guiding developers through secure coding, threat modeling, and remediation discussions.
• Experience with application security tooling (SAST, DAST, SCA, runtime monitoring) and cloud-native security practices.
• Knowledge of CI/CD, container security, and DevSecOps principles.
• Ability to read and understand code in at least one modern programming language.

Advantages

• Security certifications (e.g., AWS Security Specialty, CISSP).
• Experience with IaC tools, scripting, or programming (Terraform, Python, Bash, etc.).
• Familiarity with network security fundamentals.
• Experience using or evaluating AI for security problem-solving.

About the team