Sr. Application Security Engineer at Mitek Systems
United States
$130k - $190k
<p> </p><p>Mitek (NASDAQ: MITK) is a global leader in digital & biometric identity authentication, fraud prevention, and mobile deposit solutions. Our verified identity platform and advanced image capture solutions are built on the latest advancements in biometric recognition, artificial intelligence, computer vision and machine learning, and trusted by over 7,500 organizations worldwide. We are headquartered in San Diego, California, with operations in the United Kingdom, Spain, France, Mexico, and the Netherlands. Visit us at <a href="https://cts.businesswire.com/ct/CT?id=smartlink&url=http%3A%2F%2Fwww.miteksystems.com%2F&esheet=52795111&newsitemid=20220728006004&lan=en-US&anchor=www.miteksystems.com&index=3&md5=cc5b49681712596c06a27df1e1029ba4" title="https://cts.businesswire.com/ct/CT?id=smartlink&url=http%3A%2F%2Fwww.miteksystems.com%2F&esheet=52795111&newsitemid=20220728006004&lan=en-US&anchor=www.miteksystems.com&index=3&md5=cc5b49681712596c06a27df1e1029ba4">www.miteksystems.com</a>.</p> <p><strong>We are Virtual 1st!</strong> Whether you choose to work remotely from your home office or in-person from one of Mitek’s offices, our practices, processes and tools are designed to enable your success. At Mitek, the Future of Work is about flexibility and preference wherever and whenever we are working. Because we care about our candidates, employees and customers, we include an in-person meeting as part of our hiring process. It’s one of the ways we live our mission to “<u>Protect What’s Real.”</u></p> <p>At Mitek, we believe that teams are more resilient, effective, and innovative when they benefit from a wide range of ideas, lived experiences, and perspectives. The strength of our organization is deeply rooted in the people who power it. We know that a workforce reflecting the richness of our communities and customers helps us better serve their needs.</p> <p></p><p><br></p><p>This person will be t<span data-contrast="auto">he company's technical authority on the security of its software products. Bridges Information Security and Engineering — embedding security into the SDLC for a ~50-person development team building internet-hosted banking and financial software. Owns the vulnerability remediation program, builds upstream controls that prevent vulnerabilities, and serves as the AppSec authority in customer and regulatory engagements. The company invests from a position of strength — a recent penetration test returned zero findings — ahead of an expected rise in AI-assisted vulnerabilities targeting the financial sector.</span><span data-ccp-props="{}"> <br><br></span> </p><p> </p><p><strong><span data-contrast="auto">Why this role now</span><span data-ccp-props="{"335551550":6,"335551620":6}"> </span></strong></p> <p></p> <p> </p><p><span data-contrast="auto">The company is maturing its application security function from a position of strength — a recent penetration test returned zero findings — and is investing ahead of an expected increase in AI-assisted vulnerabilities targeting the financial sector. The AppSec Engineer joins with a clear mandate: own remediation of validated findings, build the secure development lifecycle that prevents future vulnerabilities, and establish the AppSec program credibility that banking customers and their regulators increasingly audit directly.</span><span data-ccp-props="{}"> </span></p> <p></p> <p></p>\n<p></p><p><br></p><b>What You’ll Do (Essential Responsibilities) </b><div> <div> <div> <p><span data-contrast="auto">To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed below are representative of the knowledge, skill, and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.</span><span data-ccp-props="{"335557856":16777215}"> </span></p> </div> <div> <p><span data-ccp-props="{"335557856":16777215}"> </span><span data-contrast="auto">Vulnerability Remediation</span><span data-ccp-props="{"335559685":360}"> </span></p> </div> <div> <ul role="list"> <li aria-setsize="-1" data-leveltext="●" data-font="" data-listid="3" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="1" data-aria-level="1" role="listitem"> <p><span data-contrast="auto">Own the application vulnerability remediation program with prioritized developer guidance and clear SLAs</span><span data-ccp-props="{"335559685":1080}"> </span></p> </li> </ul> </div> <div> <ul role="list"> <li aria-setsize="-1" data-leveltext="●" data-font="" data-listid="3" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="2" data-aria-level="1" role="listitem"> <p><span data-contrast="auto">Work with development squads to explain findings, validate fixes, and confirm remediation</span><span data-ccp-props="{"335559685":1080}"> </span></p> </li> </ul> </div> </div> <div> <div> <ul role="list"> <li aria-setsize="-1" data-leveltext="●" data-font="" data-listid="3" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="3" data-aria-level="1" role="listitem"> <p><span data-contrast="auto">Drive systemic root-cause fixes rather than one-by-one patching; escalate unresolved criticals and highs</span><span data-ccp-props="{"335559685":1080}"> </span></p> </li> </ul> </div> <div> <p><span data-contrast="auto">Secure Development Lifecycle</span><span data-ccp-props="{"335559685":360}"> </span></p> </div> <div> <ul role="list"> <li aria-setsize="-1" data-leveltext="●" data-font="" data-listid="3" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="4" data-aria-level="1" role="listitem"> <p><span data-contrast="auto">Define and own the SDLC — security gates and review checkpoints in sprint and release processes</span><span data-ccp-props="{"335559685":1080}"> </span></p> </li> </ul> </div> <div> <ul role="list"> <li aria-setsize="-1" data-leveltext="●" data-font="" data-listid="3" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="5" data-aria-level="1" role="listitem"> <p><span data-contrast="auto">Ensure SAST, DAST, and SCA tooling is configured, tuned, and producing actionable developer output</span><span data-ccp-props="{"335559685":1080}"> </span></p> </li> </ul> </div> <div> <ul role="list"> <li aria-setsize="-1" data-leveltext="●" data-font="" data-listid="3" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="6" data-aria-level="1" role="listitem"> <p><span data-contrast="auto">Embed security requirements into product planning and architecture decisions</span><span data-ccp-props="{"335559685":1080}"> </span></p> </li> </ul> </div> <div> <p><span data-contrast="auto">Threat Modeling & Secure Design</span><span data-ccp-props="{"335559685":360}"> </span></p> </div> <div> <ul role="list"> <li aria-setsize="-1" data-leveltext="●" data-font="" data-listid="3" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="7" data-aria-level="1" role="listitem"> <p><span data-contrast="auto">Threat-model new features and architectural changes before code is written</span><span data-ccp-props="{"335559685":1080}"> </span></p> </li> </ul> </div> <div> <ul role="list"> <li aria-setsize="-1" data-leveltext="●" data-font="" data-listid="3" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="8" data-aria-level="1" role="listitem"> <p><span data-contrast="auto">Review designs for authentication, authorization, data-flow, and cryptographic risk</span><span data-ccp-props="{"335559685":1080}"> </span></p> </li> </ul> </div> <div> <ul role="list"> <li aria-setsize="-1" data-leveltext="●" data-font="" data-listid="3" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="9" data-aria-level="1" role="listitem"> <p><span data-contrast="auto">Produce written threat models that serve as developer guidance and audit evidence</span><span data-ccp-props="{"335559685":1080}"> </span></p> </li> </ul> </div> <div> <p><span data-contrast="auto">API Security & Secure Code Review</span><span data-ccp-props="{"335559685":360}"> </span></p> </div> <div> <ul role="list"> <li aria-setsize="-1" data-leveltext="●" data-font="" data-listid="3" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="10" data-aria-level="1" role="listitem"> <p><span data-contrast="auto">Own API security standards — OAuth 2.0, mTLS, rate limiting, and abuse prevention</span><span data-ccp-props="{"335559685":1080}"> </span></p> </li> </ul> </div> <div> <ul role="list"> <li aria-setsize="-1" data-leveltext="●" data-font="" data-listid="3" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="11" data-aria-level="1" role="listitem"> <p><span data-contrast="auto">Conduct or coordinate manual secure code review of security-sensitive components</span><span data-ccp-props="{"335559685":1080}"> </span></p> </li> </ul> </div> <div> <ul role="list"> <li aria-setsize="-1" data-leveltext="●" data-font="" data-listid="3" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="12" data-aria-level="1" role="listitem"> <p><span data-contrast="auto">Lead application penetration-testing cycles — scoping, managing testers, validating findings</span><span data-ccp-props="{"335559685":1080}"> </span></p> </li> </ul> </div> <div> <p><span data-contrast="auto">Developer Enablement</span><span data-ccp-props="{"335559685":360}"> </span></p> </div> <div> <ul role="list"> <li aria-setsize="-1" data-leveltext="●" data-font="" data-listid="3" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="13" data-aria-level="1" role="listitem"> <p><span data-contrast="auto">Build and run a Security Champions program across development squads</span><span data-ccp-props="{"335559685":1080}"> </span></p> </li> </ul> </div> <div> <ul role="list"> <li aria-setsize="-1" data-leveltext="●" data-font="" data-listid="3" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="14" data-aria-level="1" role="listitem"> <p><span data-contrast="auto">Deliver developer security training on OWASP Top 10 and secure-coding patterns</span><span data-ccp-props="{"335559685":1080}"> </span></p> </li> </ul> </div> <div> <ul role="list"> <li aria-setsize="-1" data-leveltext="●" data-font="" data-listid="3" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"hybridMultilevel"}" data-aria-posinset="15" data-aria-level="1" role="listitem"> <p><span data-contrast="auto">Create runbooks, coding standards, and pattern libraries developers can apply independently</span><span data-ccp-props="{"335559685":1080}"> </span></p> </li> </ul> </div> <div> <p><span data-ccp-props="{"335557856":16777215}"> </span><span data-contrast="auto">This job description reflects management’s assignment of essential functions; and nothing in this herein restricts management’s right to assign or reassign duties and responsibilities to this job at any time.</span><span data-ccp-props="{"335557856":16777215}"> </span></p> </div> </div> <div> <div> <p><span data-contrast="auto">Managerial Responsibilities</span><span data-ccp-props="{"335557856":16777215}"> </span></p> </div> <div> <ul role="list"> <li aria-setsize="-1" data-leveltext="" data-font="Symbol" data-listid="4" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"}" data-aria-posinset="1" data-aria-level="1" role="listitem"> <p><span data-contrast="auto">Non-Manager: No oversight or accountability for others, an individual contributor, however, leads Security Champions program across development squads (developer-embedded, not security headcount)</span><span data-ccp-props="{"134233279":true,"335557856":16777215}"> </span></p> </li> </ul> </div> </div> </div><p><br></p><b>What You Need (Education/Licenses/Certifications, Experience, Knowledge, Technical Skills and Abilities) </b><div> <div> <ul> <li><span data-contrast="auto">Knowledge, skills and abilities typically gained through 5–8 years in application/product security or security-focused software engineering</span> </li> <li><span data-contrast="auto">Application penetration testing including business-logic and API testing</span> </li> <li><span data-contrast="auto">Hands-on SAST, DAST, and SCA tuning and operationalization</span> </li> <li><span data-contrast="auto">Secure code review across at least two web-application languages</span> </li> <li><span data-contrast="auto">Threat modeling using STRIDE, PASTA, or equivalent</span> </li> <li><span data-contrast="auto">Depth in OWASP Top 10 and API security risks; ability to influence development teams</span><span data-ccp-props="{}"> </span></li> </ul> </div> </div><p><br></p><b>What Would be Nice (Preferred Skills & Experience) </b><div> <div> <ul> <li><span data-contrast="auto">Financial services, fintech, or SaaS for regulated industries</span> </li> <li><span data-contrast="auto">Financial-sector threat knowledge — fraud, account takeover, API abuse</span> </li> <li><span data-contrast="auto">Cloud-native application security including container security</span> </li> <li><span data-contrast="auto">PCI-DSS application security requirements</span> </li> <li><span data-contrast="auto">OSCP, GWEB, or CSSLP</span> </li> <li><span data-contrast="auto">Prior experience building a Security Champions program</span><span data-ccp-props="{}"> </span></li> </ul> </div> </div><p><br></p><b>Success Metrics -First Year </b><div> <div> <ul> <li><span data-contrast="auto">Remediation plan for all critical/high findings within 30 days</span> </li> <li><span data-contrast="auto">Critical/high remediation above 90% within SLA by month six</span> </li> <li><span data-contrast="auto">Threat modeling applied to all major new features within 90 days</span> </li> <li><span data-contrast="auto">Security Champions program launched (1+ per squad) within six months</span> </li> <li><span data-contrast="auto">SAST and DAST tuned and developer-actionable within 60 days</span><span data-ccp-props="{}"> </span></li> </ul> </div> <div> <p><span data-ccp-props="{"335551550":6,"335551620":6}"> </span></p> </div> </div><p><br></p><b>What we Offer </b><div> <div> <ul> <li><span data-contrast="auto">Ownership of the AppSec function with clear scope and executive visibility</span> </li> <li><span data-contrast="auto">A technically interesting attack surface — internet-facing financial software, complex API integrations, and a dual US/EU regulatory context</span> </li> <li><span data-contrast="auto">Direct collaboration with the VP of IT and Security and Engineering leadership</span> </li> <li><span data-contrast="auto">A development team that is receptive to security partnership rather than treating it as an external constraint</span> </li> <li><span data-contrast="auto">A security program investing proactively from a position of strength — not reactive, not in crisis</span><span data-ccp-props="{}"> </span></li> </ul> </div> </div><p><br></p><p></p>\n<div>$130,000 - $190,000 a year</div><small><div><em>We are proud to offer competitive salary ranges aligned to industry standards. Please note that our ranges are representative and individual compensation specifics may vary based upon experience level, professional competencies and geographic differentials.</em> </div></small>\n<p> </p><p><strong>We take pride in enabling career growth in an environment of innovation and teamwork.</strong> Our commitment to all Mitekians is to do meaningful work that matters. Our culture is defined by delivering our best to our customers by providing high value solutions and impactful outcomes, by continuously challenging convention, and by caring for each other through collaboration and celebrating our successes. We are committed to creating competitive, equitable compensation & benefits programs and career development opportunities. </p> <p><strong><u>Benefit offerings –<em> </em></u></strong><em><u>may vary based on geographic location</u></em></p> <p><strong>Wellness</strong>: Universal, supplemental, and private healthcare plan choices based on country specifics </p> <p><strong>Financial future</strong>: retirement/pension plan contributions, MTK stock plan participation </p> <p><strong>Income protection: </strong>life event & disability coverage </p> <p><strong>Paid time off</strong>: generous annual leave, company holidays, volunteer time off </p> <p><strong>Learning</strong>: e-learning license, tuition reimbursement, hackathons </p> <p><strong>Home office setup allowance</strong></p> <p><strong>Additional/optional benefits</strong>: pet insurance, identity theft protection, legal assistance </p> <p>We sincerely appreciate your interest in Mitek. We know your time is valuable and look forward to the potential of speaking with you further! </p> <p></p>
Apply Now
