Senior Security Engineer (Application Security)

Join Kikoff, a fintech company dedicated to helping millions build credit. As a Senior Security Engineer, you will shape the Application Security pillar, drive the application security roadmap, and ensure the safety of our products. You will work on secure SDLC, code review, threat modeling, vulnerability management, and more. Additionally, you will own security for our authentication and session layer, secure our APIs and mobile apps, and run penetration testing and bug bounty programs.

• Conduire et façonner la feuille de route de la sécurité des applications, en définissant la stratégie et en supervisant la mise en œuvre.
• Établir les normes de codage sécurisé et construire les outils qui les appliquent, y compris SAST, SCA, et l'intégration CI.
• Diriger les programmes de test de pénétration et de bug bounty, en triant, en conduisant la remédiation et en fermant la boucle avec l'ingénierie.

• You write production code. Fluency in at least one of Ruby, Python, Go, or TypeScript, and comfort reading all of them
• 6+ years in security engineering with deep, hands-on application security experience: secure code review, threat modeling, vulnerability triage, and remediation at scale
• You have designed and shipped authentication and authorization systems, not just reviewed them. OAuth/OIDC, session management, MFA, account recovery
• Hands-on with modern AppSec tooling and the judgment to know when it is wrong: SAST, SCA, DAST, secrets scanning, CI/CD integration
• Experience securing REST/GraphQL APIs and native mobile applications
• You have run or built a pentest or bug bounty program
• Comfortable in a fintech regulated environment: PCI-DSS, SOC 2, or similar
• Securing LLM-backed product features or agentic workloads in production
• Security champions or developer education programs you started, not inherited
• Supply chain security depth: dependency provenance, artifact signing, build integrity
• Consumer fintech or financial services background
• Fraud and abuse defense: bot detection, credential stuffing mitigation, device signals