Senior Application Security Engineer

About Monarch

Monarch is an all-encompassing personal finance platform designed to simplify complex financial matters. Since launching in 2021, it has become highly recommended by both users and experts alike. Our mission is to alleviate financial stress so our users can concentrate on what truly matters. The company embraces AI integration in daily workflows to enhance decision-making and innovation, valuing curiosity and fluency in AI usage across the team. Monarch operates fully remotely, with synchronous collaboration mainly between 9 AM – 2 PM PT and asynchronous work to accommodate multiple time zones.

Role Overview

We are looking for a Senior Application Security Engineer to join our rapidly expanding Security Engineering team. Reporting to the Head of Engineering Infrastructure, you will work closely with product and engineering teams to conduct application security reviews, manage vulnerabilities, and enhance AppSec and AI security strategies as our platform scales and integrates large language models (LLMs).

Key Responsibilities

• Conduct threat modeling, perform code reviews, and assess risks for new features and significant product updates on our Django/Python platform.
• Manage and improve Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) processes, including triage, validation, and vulnerability remediation within CI/CD environments.
• Address and prioritize the vulnerability backlog while maintaining triage criteria, remediation tracking, and escalation pathways in collaboration with engineering teams.
• Coordinate and execute penetration testing and security evaluations on Monarch’s web and API interfaces.
• Implement and refine AI security review workflows to protect against prompt injection, data leakage, model exploitation, and supply chain risks associated with AI and LLM features.
• Develop and sustain security automation and AI-driven tools, and set security requirements for AI workflows and agentic systems.
• Participate in the weekly security on-call rotation to manage ongoing security operations.

Qualifications

• Minimum of 5 years of experience in security engineering, with proven expertise in Application Security and AI security involving threat modeling, SAST/DAST, secure code reviews, and vulnerability management.
• Strong proficiency in Python programming and comprehensive knowledge of web application security concepts, including OWASP Top 10 vulnerabilities, API security, and authentication/authorization patterns.
• Practical experience using application security tools such as Semgrep, Burp Suite, and Nuclei or comparable solutions.
• Understanding of AI/ML related security threats like prompt injection, model abuse, agentic attack surfaces, and supply chain risk concerning LLMs.
• Proven ability to leverage AI technologies actively to expedite security tasks and develop automation solutions.

Preferred Skills

• Experience working in fintech or handling financial data security requirements.
• Knowledge of compliance frameworks such as SOC 2 and NIST Cybersecurity Framework.
• Cloud security experience, preferably within AWS, including Identity and Access Management (IAM), container security, ECS/EKS.
• Relevant certifications like OSCP, BSCP, CSSLP, CISSP, or equivalent credentials.
• Background in detection engineering and incident response.
• Additional offensive security expertise, including red teaming, bug bounty programs, or extensive penetration testing beyond web and API surfaces.

Recruitment Process

• Initial video call with recruiter.
• Video interview with hiring manager.
• Completion of a take-home assignment.
• Virtual onsite interviews spanning 2 to 4 sessions.
• Reference checks.
• Job offer.

Benefits

• Full remote flexibility allowing you to work from your preferred location.
• Competitive salary along with equity opportunities in a fast-growing early-stage company.
• Provision of a stipend to create an optimal work environment.
• Location-based competitive benefits, such as medical, dental, vision insurance, and retirement plans for employees in the US.
• Unlimited paid time off.
• A 3-day weekend every month by taking off the first Friday to encourage rest and rejuvenation.

Equal Opportunity Statement

We are committed to creating a diverse workforce and provide equal employment opportunities regardless of race, religion, color, national origin, gender identity, sexual orientation, age, marital status, veteran status, disability, or genetic information.

Applicant Notes

In compliance with California Fair Chance Act and San Francisco Fair Chance Ordinance, we consider qualified applicants with criminal records and adhere to all relevant fair chance hiring laws.