The Senior Application Security Engineer ensures the security of systems and data by monitoring vulnerabilities, responding to incidents, and promoting security best practices within the organization.
About the Engineering Organization:
The Engineering Team at Loop thrives on a balance of agility, consistency, and performance. These pillars empower us to consistently deliver impactful value to our customers. This deep customer understanding fuels our engineering teams to be leaders in our space, bringing innovative ideas to the market.
About the Role:
As a Senior Application Security Engineer at Loop, your primary responsibility will be to ensure the security and integrity of our systems and data. This will involve actively collaborating on security projects, identifying and communicating potential risks, and implementing effective security measures.
You will play a key role in maintaining a secure environment by proactively monitoring and remediating vulnerabilities, responding to security incidents, and conducting regular security audits. You will also participate in engineering team activities, share your expertise, and mentor other team members on security best practices.
Furthermore, you will be a strong advocate for security within the organization, promoting a culture of security awareness and continuously looking for opportunities to improve our security posture.
Our Blended Work Environment:
At Loop, we’re intentional about the way we work so that we can do our best work. We call this our Blended Working Environment. We work from our HQ in Columbus, OH, or one of our Hub or Secluded locations, and are distributed throughout the United States, select Canadian provinces, and the United Kingdom. For this position, you are welcome to join us no matter where you’re located, within the United States and select Canadian provinces.
Our Tech Stack:
While Loop utilizes core technologies, the specific tech stack varies across teams. You might encounter technologies such as Vue.js, Node.js, PHP/Laravel, MySQL, DynamoDB, Docker, Kubernetes, AWS Cloud, Gitlab, and Serverless Framework. The security stack consists of Vanta, Sysdig, Cloudflare, and other vulnerability and scanning solutions.
What you’ll do:
- Participate in security projects, delivering secure and well-documented work. Support SOC2 compliance and Pen Testing initiatives.
- Deeply understand how to secure networks, applications, infrastructure, and data. Hands-on expertise in some secure software development lifecycle areas with organizational support needed for others. Provide technical guidance and identify automation opportunities.
- Utilize monitoring and vulnerability scanning tools to identify security concerns within the production environment and systems, remediate findings, or communicate them to the relevant team for triage.
- Quickly learn the team's tech stack, security tool ecosystem, and environment. Manage security projects independently, escalating when needed. Meet project deadlines and investigate automation opportunities.
- Build relationships with engineers. Give actionable security feedback to developers. Lead security discussions.
- Prioritize security issues based on risk assessments.
- Own and drive security incident response.
Your experience:
- Minimum of 7 years' combined experience in application development or devops, and security engineering.
- Experience with PHP/Laravel is a huge plus for us.
- Solid knowledge of common appsec vulnerabilities and their prevention (e.g., OWASP Top 10, SANS Top 25).
- Experience in security testing, including code review, SAST, DAST, and vulnerability scanning.
- Familiarity with incorporating security measures into all phases of software development, from initial concept to final launch including “Shift Left” security.
- Experience with SIEM, WAF, Risk Management Platforms, SAST/DAST or similar security tools.
- Deep understanding of cloud security best practices and challenges, with specific expertise in AWS security services and architectures or equivalent.
- Must be proficient in at least one scripting language (e.g., Python, Bash) to automate security tasks and integrate security tools.
- Skilled in identifying, evaluating, prioritizing, and monitoring the remediation of security vulnerabilities.
- Proven experience in handling security incidents, including identification, containment, and remediation.
- Ability to clearly communicate technical security concepts to both technical and non-technical audiences, and to collaborate effectively with development, operations, and other teams.
- Ability to analyze security issues, identify root causes, remediate and/or recommend effective solutions.
#LI-ST1
Loop Story
In a perfect world, Loop wouldn't exist. If we had our way, we'd live in a world where we're mindful about how we consume, we love every product we own, and we share values with the brands who create them. In reality, commerce isn't perfect and often breaks. Loop creates second chances.
We're starting by revolutionizing the post-purchase experience. We've taken one of the most fragile commerce interactions - returns - and turned it into something consumers actually love, and that deepens our connection to brands and products.
We take connection seriously on the inside, too. We're building a work experience that allows you to Be A Human First and prioritizes empathy and wellbeing. We view Loop as a special place in your career to shape the future of an industry and become a better person while doing it. You can grow faster here in a shorter amount of time - we'll give you space and trust you to fill it.
Learn more about us here: https://loopreturns.com/careers.
You can review our privacy notice here.
Similar Jobs
Artificial Intelligence • Enterprise Web • Information Technology • Productivity • Sales • Software • Database
The Senior Application Security Engineer will strengthen Apollo’s secure software development lifecycle through application security reviews, threat modeling, code analysis, vulnerability management, penetration testing, remediation, and AppSec tooling. The role includes developing automation, securing AI-powered features, improving security observability, enabling developers, and partnering across Engineering, Product, Platform, Data, Legal, and Security teams. This senior individual contributor will own long-term AppSec goals, resolve ambiguous risks, and drive cross-functional security improvements.
Top Skills:
Ai ApisCsrfGoogle Cloud Platform (Gcp)LinuxOauthPythonRubySastSoftware Composition Analysis (Sca)Ssrf
Healthtech
Owns application-layer security across the platform by building and tuning SAST, DAST, SCA, container, and IaC scanning programs. Triages vulnerabilities from scans, penetration tests, and bug bounties; partners with engineers on remediation; performs threat modeling; maintains secure coding standards; supports incident response; coordinates penetration testing; and reports security metrics. Requires strong application security expertise, cloud and CI/CD security experience, and effective cross-functional communication.
Top Skills:
AWSCi/CdContainer ScanningDastGoInfrastructure-As-Code ScanningOwasp Top 10PythonSastSoftware Composition Analysis (Sca)Terraform
Manufacturing
Implements and operates application security controls, scanners, governance processes, and cloud infrastructure for global digital brands. Develops APIs, scripts, Kubernetes clusters, and infrastructure-as-code automation; conducts application security reviews, threat modeling, adversarial testing, and vulnerability assessments. Partners with development and operations teams to communicate findings, guide remediation, and promote secure software development practices across cloud-native environments.
Top Skills:
APIsCi/CdCloud ComputingCloud-Native DevelopmentDastDockerInfrastructure As Code (Iac)KubernetesSast
What you need to know about the Boston Tech Scene
Boston is a powerhouse for technology innovation thanks to world-class research universities like MIT and Harvard and a robust pipeline of venture capital investment. Host to the first telephone call and one of the first general-purpose computers ever put into use, Boston is now a hub for biotechnology, robotics and artificial intelligence — though it’s also home to several B2B software giants. So it’s no surprise that the city consistently ranks among the greatest startup ecosystems in the world.
Key Facts About Boston Tech
- Number of Tech Workers: 269,000; 9.4% of overall workforce (2024 CompTIA survey)
- Major Tech Employers: Thermo Fisher Scientific, Toast, Klaviyo, HubSpot, DraftKings
- Key Industries: Artificial intelligence, biotechnology, robotics, software, aerospace
- Funding Landscape: $15.7 billion in venture capital funding in 2024 (Pitchbook)
- Notable Investors: Summit Partners, Volition Capital, Bain Capital Ventures, MassVentures, Highland Capital Partners
- Research Centers and Universities: MIT, Harvard University, Boston College, Tufts University, Boston University, Northeastern University, Smithsonian Astrophysical Observatory, National Bureau of Economic Research, Broad Institute, Lowell Center for Space Science & Technology, National Emerging Infectious Diseases Laboratories
