.png)
Build and scale application security for a SaaS platform by integrating SAST, SCA, DAST, secrets scanning, and container/IaC checks into CI/CD. Partner with engineering and DevOps teams on threat modeling, secure code reviews, vulnerability remediation, incident response, and secure development practices. The role also supports compliance goals and translates security risks clearly to engineers.
Vannevar builds AI systems for the Department of War's most consequential missions. We have 125 deployments across every branch and combatant command spanning our core platform and five distinct products. An an example of how we work, when major combat operations started with Iran, we fielded a new product supporting 24/7 operations and 9,000+ users in three months.
How we build is our advantage: we deploy forward with the people who own the mission. Our engineers, product team, and CTO deploy forward to the point of friction, including visiting units in Ukraine. We focus on embedding directly with operational units supporting great power competition with China, combat operations with Iran, and counter-narcotics missions.
About the role
As an Application Security Engineer, you will help build security into our SaaS platform, ensuring we can quickly ship secure features to our customers. You will partner with software, DevOps, and platform teams, while coordinating with audit partners, to embed threat modeling, automated SAST/SCA/DAST, and rapid vulnerability response into every stage of our SDLC. Your work will be pivotal in protecting customer data, meeting compliance milestones, and scaling our security posture as the company grows.
What you'll do- Implement and deploy enterprise standard SAST, SCA, secrets-scan, DAST, and container/IaC checks in CI/CD
- Embed with development teams to run threat models, review critical PRs, and coach secure-by-default habits.
- Drive a shift-left vulnerability detection program to identify and remediate vulnerabilities earlier in the software development lifecycle (SDLC).
- Coordinate with DevOps for application security issues that cross between application and infrastructure layers
- Support incident-response for product issues and feed lessons back into code, docs, and process.
- 5 + years in Application / Product Security
- Hands-on experience securing web applications and automating AppSec workflows.
- Familiarity with DevSecOps practices and container security & patching
- Experience with GitHub Actions, Python, TypeScript/JavaScript
- Clear, concise communicator who can translate risk for engineers
- Experience securing LLM workflows
- Experience with NIST Risk Management Framework
- Experience with software security at a U.S. defense contractor
- Active Security Clearance (or ability to obtain one) and willingness to travel onsite
Benefits:
The salary range for this position is $160,000 - $210,000 + equity + 401K match. Within the range, individual pay is determined by experience, relevant education, and/or training.
- Health, dental, and vision insurance
- 100% remote - work from anywhere in the US
- 401k matching
- Mental benefits
- Flexible work environment - you manage your workday
- Pet and child care reimbursement during travel
- Unlimited PTO
The salary range for this position is $160,000 - $210,000 + equity + 401K match. Within the range, individual pay is determined by experience, relevant education, and/or training.
Vannevar is an equal opportunity employer, and qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender perception or identity, national origin, age, marital status, protected veteran status, or disability status.
We encourage candidates from all backgrounds to apply, even if you don't feel like you're a perfect fit. If you're passionate about contributing to our mission, we'd love to hear from you!
IMPORTANT NOTICE
We are committed to protecting the privacy of all applicants. Official emails from the company will come from an @vannevarlabs.com domain. Under no circumstances will a legitimate representative from our company contact you to request passwords, financial information, or other sensitive personal data. Please be vigilant of potential scams.
We are committed to protecting the privacy of all applicants. Official emails from the company will come from an @vannevarlabs.com domain. Under no circumstances will a legitimate representative from our company contact you to request passwords, financial information, or other sensitive personal data. Please be vigilant of potential scams.
Vannevar New York, New York, USA Office
66 Hudson Yards, New York, NY, United States, 10001
Similar Jobs at Vannevar
Artificial Intelligence • Machine Learning • Software • Defense
Build and ship a full-stack data collection and search platform for defense and intelligence users. Develop frontend, backend, data ingestion, storage, indexing, APIs, and agentic AI capabilities using TypeScript, React, Tailwind, Node.js, PostgreSQL, and AWS. Partner with mission owners, customers, designers, and engineers to translate intelligence workflows into intuitive, mission-ready products supporting information analysis and visualization.
Top Skills:
Ai AgentsAWSNode.jsPostgresReactTailwind CssTypescript
Artificial Intelligence • Machine Learning • Software • Defense
Own and improve the corporate endpoint environment across macOS, Windows, and iOS. Manage MDM, patching, vulnerability remediation, configuration, monitoring, compliance, and device lifecycle processes. Develop scripts and automation to deploy controls, detect drift, remediate issues, and reduce manual administration. Partner with Security and IT to implement CIS and NIST requirements, investigate complex endpoint problems, and lead technical projects from planning through deployment.
Top Skills:
AutomationBashCis BenchmarksConfiguration ManagementEndpoint Health MonitoringEndpoint PatchingiOSmacOSMdmMicrosoft IntuneNist 800-171PowershellPythonTelemetryVulnerability ManagementWindows
Artificial Intelligence • Machine Learning • Software • Defense
Owns build and deployment automation, platform health, scaling, monitoring, and high-availability DevOps pipelines. The role involves developing self-service tools, expanding a multi-account AWS environment, improving SRE practices, and securing systems for commercial and high-side environments. Requires strong AWS, CI/CD, infrastructure-as-code, containerization, scripting, and monitoring expertise, plus U.S. citizenship and TS/SCI with full-scope polygraph clearance. Travel to a Washington, DC customer site may reach 50%.
Top Skills:
AWSAws GovcloudBashDatadogDockerElasticsearchGithub ActionsOpensearchPlg StackPulumiPythonSQLTerraformVpns
What you need to know about the NYC Tech Scene
As the undisputed financial capital of the world, New York City is an epicenter of startup funding activity. The city has a thriving fintech scene and is a major player in verticals ranging from AI to biotech, cybersecurity and digital media. It also has universities like NYU, Columbia and Cornell Tech attracting students and researchers from across the globe, providing the ecosystem with a constant influx of world-class talent. And its East Coast location and three international airports make it a perfect spot for European companies establishing a foothold in the United States.
Key Facts About NYC Tech
- Number of Tech Workers: 549,200; 6% of overall workforce (2024 CompTIA survey)
- Major Tech Employers: Capgemini, Bloomberg, IBM, Spotify
- Key Industries: Artificial intelligence, Fintech
- Funding Landscape: $25.5 billion in venture capital funding in 2024 (Pitchbook)
- Notable Investors: Greycroft, Thrive Capital, Union Square Ventures, FirstMark Capital, Tiger Global Management, Tribeca Venture Partners, Insight Partners, Two Sigma Ventures
- Research Centers and Universities: Columbia University, New York University, Fordham University, CUNY, AI Now Institute, Flatiron Institute, C.N. Yang Institute for Theoretical Physics, NASA Space Radiation Laboratory
