Staff Application Security Engineer

Build AI contracting at enterprise scale. Ship it fast.
Ironclad is building AI on one of the most consequential datasets in enterprise software: over 2 billion contracts across thousands of the world's largest organizations. Contracts run every dollar, deal, and business relationship on the planet, and the AI transformation of this space is still largely uncharted. Engineers here are building agentic solutions to problems that haven't been solved yet, in a category that's still being defined. The feedback loop is short, the data is rich, and the people closest to the work are the ones deciding what gets built next. That ability to deliver impact quickly is why the the companies at the forefront of AI choose Ironclad to manage their contracts.
We’re consistently recognized as a leader in the industry: a Leader in the Forrester Wave and Gartner Magic Quadrant for Contract Lifecycle Management, a Fortune Great Place to Work, and one of Fast Company’s Most Innovative Workplaces. Ironclad has also been named to Forbes’ AI 50 and Business Insider’s list of Companies to Bet Your Career On. We’re backed by leading investors including Accel, Y Combinator, Sequoia, BOND, and Franklin Templeton. For more information, visit www.ironcladapp.com or follow us on LinkedIn.

This is a hybrid role. Office attendance is required at least twice a week on Tuesdays and Thursdays for collaboration and connection. There may be additional in-office days for team or company events.

Ironclad is seeking an experienced Application Security Engineer with a passion for securing modern software platforms and protecting sensitive data. We are looking for someone with strong experience in automated vulnerability scanning and penetration testing to strengthen our application security program. Whether you are better at building software or better at breaking it, we are interested in hearing from you. We welcome security researchers and strong developers, as well as past security engineers.
This role will be responsible for conducting security assessments, identifying and mitigating risks, and implementing security best practices and process improvements across Ironclad’s Product, Platform and Engineering teams.

Roles & Responsibilities:
Develop and implement secure coding practices, procedures, and standards for software development teams.

Conduct application security assessments and vulnerability testing to identify and mitigate risks.

Perform security reviews of code changes and ensure that security issues are addressed.

Collaborate with cross-functional teams to remediate software vulnerabilities and implement secure coding practices.

Integrate security review processes into Ironclad’s CI/CD pipeline.

Conduct threat modeling and risk analysis to protect sensitive data.

Provide domain expertise on protective controls including system, network, encryption, and authentication services.

Work closely with members of the SRE, Development, IT, and Security teams to drive impactful changes to Ironclad’s cybersecurity posture.

Work closely with the risk and governance teams to implement compliance and security requirements.

Contribute to secure coding and other cybersecurity training programs.

Stay up-to-date with the latest security trends, vulnerabilities, and attack techniques.

Provide technical leadership and mentorship to other members of the engineering and security teams.

Key Skills:
Strong proficiency in either Typescript or Javascript.

3+ Years of experience working in application security or software development, preferably with SaaS companies or in regulated fields.

In-depth knowledge of application security concepts and practices, including OWASP Top 10 and SANS Top 25.

Experience with security testing tools such as Burp Suite, AppScan, and Nessus.

Experience operating in any cloud provider (AWS, GCP, Azure, Digital Ocean etc.).

Ability to appropriately prioritize and respond to different escalations.

Experien