Sr. Application Security Engineer

*** Please note that this is a HYBRID role, requiring this person to work at our Cottonwood Heights office in SLC two days a week. We are not able to provide work sponsorship (i.e. OPT, STEM-OPT or H-1B visa) for this role ***

As a Sr. Application Security Engineer at Extra Space, you'll be a trusted security partner embedded in how our engineering teams design, build, and ship software. You'll work across our Product Engineering org alongside principal and staff engineers, the cybersecurity team, and a security champion on every engineering team, building security in from the start. Our applications run on AWS and Vercel. They're built mostly with C# .NET, TypeScript, and React/Next.js, backed by SQL Server and other relational and non-relational databases.

Duties & Responsibilities

• Conduct security architecture and design reviews for new and evolving features, surfacing risk early and recommending practical mitigations.
• Perform threat modeling and manual and automated code reviews, and partner with developers to prioritize and remediate what you find.
• Drive a risk-based approach to application security, helping teams understand vulnerabilities in terms of business impact.
• Mature our Secure SDLC, including secure coding standards, security requirements, and automated checks (SAST, DAST, SCA, secrets scanning) in our CI/CD pipelines.
• Build and maintain security tooling and automation that scales across teams, with a focus on reducing risk rather than adding tools.
• Lead and grow the security champions program, training champions so each team has security expertise close at hand.
• Serve as the application security subject matter expert for engineering, product, and leadership, and mentor engineers on secure development practices.
• Make sure AI tools and AI-powered features are adopted within acceptable risk limits.
• Align our applications with SOC 1, SOX, CIS v8, and PCI DSS (SAQ-A, SAQ-P2PE), and support audits with evidence and remediation plans.

Requirements

• 6+ years of combined experience in software engineering, application security, product security, or a closely related field.
• Proficiency in most of our primary languages (C# .NET, TypeScript, JavaScript, SQL).
• Experience securing web applications built on modern frameworks and cloud-native architectures, particularly AWS.
• Hands-on white-box testing and secure code review experience.
• Strong understanding of SSDLC principles and experience implementing or maturing secure development programs.
• Solid understanding of common vulnerabilities and attack techniques (OWASP Top 10, API security, authentication and authorization flaws).
• Experience integrating security tooling into delivery pipelines (GitHub, TeamCity, or similar).
• Familiarity with AI security risks and emerging attack surfaces, including agentic systems, MCP, and LLM-powered workflows.
• A risk-focused mindset: you can explain security risk in business terms, weigh it against the business's needs and risk tolerance, and help teams make pragmatic decisions without security theater.
• A proven ability to build trusted relationships with engineering teams and guide behavior without direct authority.
• Strong written and verbal communication, equally comfortable in a design review with engineers and a risk conversation with leadership.

Preferred Qualifications

• Development experience with Next.js, Vercel, or serverless architectures.
• Practical knowledge of security frameworks and standards such as OWASP ASVS, NIST 800-53, CIS v8, PCI DSS, or SOX.
• Hands-on security certifications such as OSCP, BSCP, GWEB, PNPT, or similar.
• Experience running or triaging a bug bounty program.
• Bachelor's degree in Computer Science, Information Security, or a related field.

Work Environment & Physical Requirements
Performs sedentary work in an office environment with limited lifting (less than 10 pounds) or walking required. Close visual acuity required to perform work at computer terminal. No exposure to adverse environmental conditions. Requires repetitive typing motion, talking, hearing, grasping and feeling.

Disclaimer
The job description outlines the general nature and scope of work employees perform in this role. It's not intended to be an exhaustive list of all duties, responsibilities, or qualifications required for the position. The company reserves the right to modify, revise, or update the job description to meet business needs.

If you are a current Extra Space employee, please apply through Jobs Hub in Workday.

We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.

Applications Deadline: Applications will be accepted until the position is filled.