Senior Application Security Engineer III

As a Senior Application Security Engineer at Spring, you are a technical leader and a trusted problem solver who works at the intersection of security, engineering, and the business.

You own Spring’s application security strategy and roadmap, aligning initiatives with risk priorities, business needs, and platform evolution.

You collaborate closely with product engineering, DevOps, platform, and compliance leaders to deeply understand the “why” behind the work, ensuring the controls you design directly support customer trust, regulatory commitments, and Spring’s ability to ship quickly without compromise.

You lead the design and rollout of secure development practices that span the organization, including threat modeling, secure code review, dependency management, and static and dynamic analysis.

You own and evolve Spring’s Secure Development Lifecycle, embedding security reviews, tooling, and guardrails into CI/CD workflows so security becomes part of how engineers build, not a gate they navigate around.

You bring architectural foresight to the most sensitive systems we operate, balancing competing constraints, identifying long-term risks, and making thoughtful trade-offs between speed, defense-in-depth, and developer experience.

You have a track record of making security simpler, more reliable, and more maintainable over time, and of influencing others to do the same.

This is primarily an individual contributor role, but you may lead a small team of engineers or act as the technical owner for application security across the organization.

You lead by example through strong technical execution, collaborative problem-solving, and a practical, risk-aware approach to security.

You evaluate and implement security tools and services (e.g., SAST, DAST, SBOM, secrets scanning, WAF, CSPM) that improve detection and resilience, and you measure their impact rather than their presence.

You model and champion the use of AI tools in the application security process, using them to increase coverage, speed, and exploratory capacity across reviews, threat modeling, and detection engineering.

You help others adopt AI responsibly, and you remain critical of its output, especially in security-sensitive contexts where confident wrong answers are dangerous.

You set the bar for testing, automation, and operational excellence in everything appsec touches.

You are a strong partner to engineering leadership, product, compliance, and the executive team.

You help leaders frame complex security trade-offs, clarify ambiguous risks, and align technical decisions with business strategy.

You own or contribute to incident response for application-related exposures, lead post-incident learning, and translate findings into systemic improvements.

You support Spring’s compliance posture, including SOC 2 readiness and audit participation, and you track and communicate Spring’s application security posture through clear metrics, risk registers, and executive-level reporting.

You mentor application security engineers and elevate the practice across Spring.

What you’ll do:

• Shape and drive Spring’s application security strategy and roadmap, aligning initiatives with risk priorities, business priorities, and platform evolution.

• Lead the definition and rollout of secure development practices across engineering: threat modeling, secure code review, dependency management, and static and dynamic analysis.

• Define and manage Spring’s SDL, embedding security reviews, tooling, and guardrails into CI/CD workflows and moving them from advisory to enforced with clear exception handling.

• Partner with engineering, DevOps, and platform teams to identify and remediate security risks across applications, services, APIs, and cloud environments.

• Evaluate, select, and implement security tools and services (e.g., SAST, DAST, SBOM, secrets scanning, WAF, CSPM) that meaningfully improve detection and resilience.

• Champion the responsible use of AI in application security workflows, and identify opportunities to integrate AI into Spring’s security tooling and detection capabilities.

• Set the security bar for AI-powered features and internal AI tooling, including risks such as prompt injection, data leakage, and excessive agent permissions.

• Own or contribute to incident response for application-related vulnerabilities and exposures, leading post-incident learning and turning findings into systemic improvements.

• Support Spring’s compliance posture, including SOC 2 readiness, audit participation, and evidence gathering for application-level controls and privacy obligations (e.g., PIPEDA).

• Act as a subject matter expert for product and engineering teams on secure architecture, data protection, and third-party risk.

• Mentor and grow the appsec team, supporting both technical depth and cross-functional influence; may lead a small team of engineers.

• Track and communicate security posture through clear metrics, risk registers, and executive-level reporting.

What we're looking for: