Staff Application Security Engineer (R5949)

Shield AI is a venture-backed defense-tech company with the mission of protecting service members and civilians with intelligent systems. Its products include Hivemind autonomy software, V-BAT and X-BAT aircraft, and Aechelon simulation and synthetic reality technologies. With offices and facilities across the U.S., Europe, the Middle East, and Asia-Pacific, Shield AI’s technology actively supports operations worldwide. For more information, visit www.shield.ai. Follow Shield AI on LinkedIn, X, Instagram, and YouTube. 

We are seeking a Staff Application Security Engineer to build and advance a scalable, developer-centered application security program. This role will establish company-wide secure software development lifecycle (SDLC) policy and standards, translate them into practical engineering practices, and partner directly with product, platform, and development teams to improve secure development and software supply-chain maturity.

The successful candidate combines technical application-security depth with the programmatic leadership to drive enterprise-wide improvement. You will help teams build, test, package, release, and maintain secure software while ensuring security controls are practical, measurable, and integrated into existing engineering workflows.

This is a Staff level individual-contributor role with significant influence across engineering, security, product, and technology leadership.

What you'll do:

* Establish, maintain, and continuously improve company-wide secure SDLC policies, standards, control objectives, procedures, and supporting evidence requirements. * Translate security policy into clear, achievable requirements for development, product, and platform teams without creating unnecessary delivery friction. * Assess the maturity of development teams, CI/CD pipelines, source-control practices, build environments, and release processes; define and lead practical improvement roadmaps. * Develop secure-development guidance, reference architectures, reusable patterns, security guardrails, exception processes, and developer enablement materials. * Partner directly with development teams to identify, triage, prioritize, remediate, and verify application-security findings. * Evaluate, implement, tune, and operationalize application-security tooling, including:* Static application security testing (SAST) * Dynamic application security testing (DAST) * Software composition analysis (SCA) * Secrets detection * Infrastructure-as-code security scanning * Container and image security scanning * API and cloud-native application security controls

* Ensure security tooling produces actionable, appropriately prioritized findings and does not create unnecessary developer burden through excessive false positives. * Lead or facilitate threat modeling, security requirements definition, and secure design or architecture reviews for high-risk applications, integrations, and material changes. * Establish risk-based vulnerability management processes, including severity criteria, remediation service-level objectives, compensating controls, formal risk acceptance, escalation, and exception management. * Develop and maintain processes for identifying, tracking, and remediating vulnerable third-party, open-source, and transitive dependencies. * Establish open-source software governance, including component inventory, license identification, license review, approval workflows, and policy enforcement. * Mature software supply-chain security practices, including:* Machine-readable software bills of materials (SBOMs) * Vulnerability Exploitability eXchange (VEX) or equivalent vulnerability-status communications * Build and release provenance * Artifact, package, container-image, and binary signing * Artifact verification and trusted promotion processes * Secure artifact repositories and package registries * Approved dependency sources and package integrity verification * SLSA-aligned build integrity, provenance, and release c …