Software Security Engineer

Software Security Engineer

Salary: $145,000-160,000, based on experience

Help Shape the Future of Application Security at a Growing RegTech SaaS Company

ComplyAuto is a fast-growing RegTech SaaS company helping organizations strengthen compliance, security, and operational efficiency through cloud-based software. What started in automotive privacy compliance has expanded into cybersecurity, environmental, health & safety, and legal compliance-creating exciting opportunities to build, improve, and scale in a high-impact environment.

ComplyAuto is looking for a hands-on Software Security Engineer to help shape and scale our application security program. In this high-impact individual contributor role, you'll work closely with the Director of Information Security and our Development team to identify risk, strengthen our codebase, and embed security into the way we build software.

This is an ideal opportunity for someone who enjoys going deeper than automated tooling, conducting manual code reviews, testing real-world application risk, and partnering directly with engineers to design secure, practical solutions. You'll play a key role in securing modern JavaScript and TypeScript applications, improving our CI/CD security practices, and driving application security initiatives across a fast-moving, high-growth SaaS environment.

What You'll Do

You'll lead day-to-day application security efforts across ComplyAuto's software environment, including secure code reviews, threat modeling, manual security assessments, penetration testing, and vulnerability remediation. You'll work directly with developers to identify risks in JavaScript, TypeScript, React, Node.js, APIs, databases, and cloud-based SaaS applications, then provide clear, actionable guidance to fix issues at the source.

You'll also help mature and design our application security program by developing security policies, documenting controls, implementing security testing tools, automating SAST and DAST capabilities within CI/CD pipelines, delivering secure coding training, and supporting incident response for application-related events.

What We're Looking For

We're looking for someone with 5-7+ years of experience in application security, software development, or a related security engineering role, with strong hands-on experience reviewing code and identifying vulnerabilities that automated tools may miss. You should be comfortable working in TypeScript, JavaScript, or Python, and familiar with modern development environments such as React and Node.js.

The right candidate will bring experience securing APIs, relational databases, SaaS applications, and cloud infrastructure across AWS, Azure, or GCP. You should also have experience configuring and managing SAST and DAST tools such as Snyk, Checkmarx, Veracode, Synopsys, StackHawk, Qualys, or Burp Suite.

Strong communication is essential. You'll need to translate complex technical risks into practical recommendations for both technical and non-technical stakeholders. Familiarity with secure coding standards, web application architecture, security and compliance frameworks such as NIST CSF, CIS, SOC 2, and PCI-DSS, and regulatory requirements such as CCPA and GLBA will help you succeed in this role.

Why This Role Matters

This is not a checkbox security role. You'll have direct influence over how ComplyAuto builds, tests, and secures its products. You'll partner with engineering, strengthen our application security posture, and help ensure our platforms remain secure, scalable, and trusted as we continue to grow.

Benefits:

• 401(k) 5% match (1:1)

Browse our curated collection of remote jobs across all categories and industries, featuring positions from top companies worldwide.



• Medical, dental, and vision insurance; premiums we pay 100% for employee and family


• HSA contribution for qualifying plans


• Unlimited Paid time off and 11 observed holidays


• Laptop and related hardware required provided

Applicants must be authorized to work in the United States and provide proof of work authorization within three days of hire. ComplyAuto is unable to sponsor or transfer employment visas for this role at this time.

This is a fully remote opportunity for candidates residing in the Continental United States. Please note we are not accepting applications from candidates residing in California, Hawaii, or Alaska for this position.

ComplyAuto is an equal opportunity employer and participates in E-Verify.