Staff Application Security Engineer

ABOUT THE ROLE

The Staff Application Security Engineer is instrumental in ensuring Peloton’s applications, services, and systems are implemented and secured with industry standard processes. The candidate will help define and mature the application security program, security policy and standards and will coordinate with engineering and platform partners to ensure the security bar is upheld. The candidate will work with multiple and diverse teams across Peloton including, but not limited to Product, Platform, and Ecommerce Engineering, Legal, Enterprise IT Operations and Security Response. They will coordinate the actions of each and ensure collectively we are working as “one Peloton” to protect our members and the team.

The role plays a critical function in constantly evolving Peloton’s risk assessment and security review capabilities, ensuring the underlying data related to security defects is used to constantly improve the security of Peloton's products and services. The ideal candidate is a proven engineer that has both exemplary engineering and interpersonal skills. They have extensive experience collaborating with internal engineering partners. They are a proven security technology and methodology expert that scales through enabling other engineering partners to make the right security design decisions and trade-offs.

YOUR DAILY IMPACT AT PELOTON

• Security Design Reviews/threat models: Ensure security guarantees are integrated into products by conducting thorough reviews of design and implementations.
• Developer Guidance: Provide guidance and education to engineering and product teams on available security controls and their appropriate use to help prevent vulnerabilities.
• Collaboration with Engineering Teams: Partner closely with product and engineering teams to design solutions that are secure by default.
• Expertise in Web and Mobile Security: Serve as a trusted advisor, offering web and mobile security expertise to enable engineering and product teams to make informed, confident decisions.
• Automated Analysis and Secure Frameworks: Scale security efforts by integrating automation for the identification, prioritization, and remediation of vulnerabilities. Empower engineering teams through automation, security guidance, tooling, patterns, and training to scale security practices across the organization.

YOU BRING TO PELOTON

• 7+ years of application security experience
• 2+ years experience with understanding devsecops pipelines
• 3+ years experience with software development preferred but not required
• Has proven experience in security automation, DevSecOps, SRE, or a similar role.
• Working knowledge of one or more general purpose programming/script languages, preferably Python
• Contributions to the security community (public research, blogging, presentations, bug bounty, etc.) would be a plus
• Has a solid understanding of cybersecurity threats, vulnerabilities, and mitigations.
• Has excellent problem-solving skills, with the ability to work independently and handle multiple tasks.
• Experience writing software that enables security processes
• Breadth of applied knowledge across application and infrastructure security
• Facilitate high impact, cross-team security initiatives
• The capability to establish clear next steps when facing uncertain situations without clear lines of ownership
• An ability to think creatively and holistically about reducing risk in a complex environment
• Demonstrates a focused approach, consistently achieving measurable improvements to the security posture of applications and systems.
• Exceptional ability to build relationships across diverse multi-functional teams.
• Exceptional written/oral communication skills.
• Exceptional bias for action and ownership.

#LI-AC1 

#LI-Hybrid