Staff Application Security Engineer

Keeper Security is hiring a Staff Application Security Engineer to lead and advance our in-house application security program. This role combines deep technical expertise with strategic influence. You will define, execute, and scale Keeper’s application security initiatives across our globally distributed platform. This is a 100% remote position with an opportunity to work a hybrid schedule for candidates based in the El Dorado Hills, CA or Chicago, IL metro area!

Keeper’s cybersecurity software is trusted by millions of people and thousands of organizations globally. Keeper is published in 21 languages and is sold in over 150 countries. Join one of the fastest-growing cybersecurity companies and help secure our industry-leading platform.

About Keeper

Keeper Security is transforming cybersecurity for organizations around the world with next-generation privileged access management. Keeper’s zero-trust and zero-knowledge cybersecurity solutions are FedRAMP and StateRAMP Authorized, FIPS 140-2 validated, as well as SOC 2 and ISO 27001 certified. Keeper deploys in minutes, not months, and seamlessly integrates with any tech stack to prevent breaches, reduce help desk costs and ensure compliance. Trusted by thousands of organizations to protect every user on every device, Keeper is the industry leader for best-in-class password management, secrets management, privileged access, secure remote access and encrypted messaging.  Learn more at KeeperSecurity.com.

About the Role

The Staff Application Security Engineer will be responsible for leading Keeper’s application security program and embedding security into every phase of the SDLC. This hands-on leadership role will include internal penetration testing, secure design reviews, bug bounty management, and security research to identify and mitigate emerging threats. You will work directly with the CTO, partner with third-party security experts, and collaborate with development teams to proactively reduce risk, strengthen defenses, and scale Keeper’s security posture globally.

Responsibilities

• Define and drive Keeper’s application security strategy, ensuring alignment with business and engineering goals
• Lead internal penetration testing and advanced security assessments for Java- and React-based applications
• Conduct architecture reviews and threat modeling for high-impact features and services
• Own and manage Keeper’s bug bounty program, including triage, validation, and developer enablement
• Partner with engineering teams to embed secure coding practices, provide remediation guidance, and influence the SDLC
• Collaborate with third-party penetration testing partners and validate findings at scale
• Develop, enhance, and automate application security tooling, scripts, and workflows
• Conduct forward-looking security research to identify emerging threats and inform proactive defenses
• Mentor and guide engineers across the organization in secure design and implementation
• Provide executive-level reporting and clear communication of vulnerabilities, risks, and mitigations

• 10+ years of combined experience in software engineering and security roles, with at least 5+ years focused on application security
• Deep expertise in web application security, secure architecture design, and the OWASP Top 10
• Strong proficiency in penetration testing, code review, and security assessment of Java and React applications
• Proven ability to lead security initiatives across multiple engineering teams and influence secure development at scale
• Hands-on experience managing bug bounty programs (HackerOne, Bugcrowd, etc.)
• Proficiency with tools such as Burp Suite, OWASP ZAP, Metasploit, or similar
• Strong programming and scripting skills (Java, JavaScript/React, Python, Bash, or equivalent)
• Excellent communication skills, with the ability to translate technical risk into business context for leadership

Preferred Qualifications

• Offensive Security certifications (OSCP, OSWE, or equivalent)
• Experience integrating security into CI/CD pipelines and cloud-native environments
• Background in vulnerability research, exploit development, or advanced security R&D
• Track record of publishing or presenting security research at conferences or industry forums

• Medical, Dental & Vision (Inclusive of domestic partnerships)
• Employer Paid Life Insurance & Employee/Spouse/Child Supplemental life
• Voluntary Short/Long Term Disability Insurance
• 401k (Roth/Traditional)
• A generous PTO plan that celebrates your commitment and seniority (including paid Bereavement/Jury Duty, etc)
• Keeper Security, Inc. is an equal opportunity employer and participant in the U.S. Federal E-Verify program. We celebrate diversity and are committed to creating an inclusive environment for all employees.

Classification: Exempt