Merge
Security Engineer
$170K–$200K
San Francisco, CA · On-site · Full-time · Posted Sep 9, 2026
- Experience
- 3–6+ years of security engineering experience, with a strong focus on product or application security.
About the job
Owns product and application security across Merge’s platform, finding and remediating vulnerabilities and embedding security into product development.
What you'll do
- Conduct security reviews, threat modeling, and code reviews; drive vulnerability remediation across the SDLC.
- Build and mature application security practices, including testing tools, CI/CD security, and developer guidance.
- Operate the bug bounty program and use AI to test application and system resiliency.
What they ask for
- 3–6+ years of security engineering experience focused on product or application security.
- Deep familiarity with application security, including OWASP, vulnerability classes, secure API design, and authentication and authorization patterns.
- Experience conducting threat modeling and secure code reviews; hands-on experience with SAST, DAST, SCA, and CI/CD security integration.
- Experience coding in at least one major programming language and in a SaaS or API-driven environment.
Nice to have
- Experience with AI/LLM security, agent security, or securing data-heavy API platforms.
- Familiarity with multi-tenant systems and their security challenges.
Pay
$170,000 - $200,000 USD base salary
Tools
OWASP, SAST, DAST, SCA, CI/CD
AI focus
Use AI to test application and system resiliency; secure AI-powered features and agent tooling.
Model-written summary · the original posting is authoritative