Application Security Engineer

As PandaDoc continues to scale, we’re expanding our security team and looking for an Application Security Engineer to help shape and strengthen our security foundations. In this role, you’ll take ownership of key security initiatives across our application, working closely with engineering to embed security into every stage of development. You’ll contribute to building a proactive, automation-driven security culture while addressing both current risks and emerging challenges, including AI security. In this role, you will: Review, test, and monitor our applications to identify security weaknesses Manage vulnerabilities from discovery through remediation, working directly with engineering teams to resolve them Respond to infrastructure security alerts and perform hardening, including reviewing roles and permissions across services and APIs Participate in incident response and root cause analysis Analyze and monitor relevant security threats and prevention measures based on industry trends and standards Partner with product, development, and infrastructure teams to embed security requirements into how they build Integrate and operate automated security testing across the development lifecycle, including SAST, DAST, SCA, secrets detection, container, and supply chain security Develop security automation and tooling to scale security across engineering Drive threat modeling and secure-by-design practices across our services Assess our overall security posture and identify risks, providing recommendations to strengthen it Assist in addressing emergent threats in AI security as PandaDoc deploys AI in its product and for internal use Our stack: Service-oriented architecture Main development stacks: Java/Spring, Python/Django, JavaScript/React Docker, Kubernetes Amazon Web Services: EKS, RDS, S3, ElastiCache, etc. Monitoring stack: Grafana, Loki, Tempo, Mimir Source control & CI/CD: GitHub / GitHub Actions A combination of AWS native and 3rd party security solutions for infr