Senior / Staff Application Security Engineer

• We’re looking for a Senior / Staff Application Security Engineer to own the security of how our product is built
• You’ll be the person who makes sure our code, APIs, and services are secure by design — threat-modeling the product, hardening the application layer, and building the AppSec practice from the ground up
• Execute application security end to end: threat-model features and services, and drive remediation of the most significant risks
• Secure the application layer against the vulnerabilities that matter most — injection, broken authentication and authorization, and insecure APIs
• Build and run a secure SDLC: code-review guardrails, SAST/DAST, dependency and supply-chain security, secrets management, and pre-production testing
• Harden authentication, authorization, and session/identity handling across the product
• Secure the AI-specific application surface — model and inference endpoints, prompt and input handling, and the new classes of vulnerability that come with shipping generative features
• Partner with product and platform engineering to design security in early and raise the security bar across the codebase
• Set the standard for how engineering reasons about and ships secure code

Benefits

• Retirement Match: Suno offers a Traditional 401(k) plan and Roth 401(k) plan with a 3% Safe Harbor company match.
• Medical, Dental & Vision: We offer competitive medical, dental, vision insurance for employees and dependents.
• Commuter Benefit: Generous monthly stipend for commuting expenses.
• Lunch Program: Suno offers free lunch 5 days a week in each of our office locations.
• Time Off: Suno employees are provided with unlimited paid time off as well as unlimited sick days + 11 company holidays.
• Creative Education Stipend: Annual reimbursements for creative education and development.
• Parental Leave: 16 weeks of fully paid parental leave to both birthing and non-birthing parents.

Preferred experience

• 6+ years in security engineering with deep, hands-on application-security expertise
• A builder who has stood up AppSec practices and secure-SDLC tooling, not only operated established ones
• Fluent in modern application stacks and comfortable in AWS
• Able to write and ship production-quality code, not only review it
• Able to work shoulder-to-shoulder with engineers and raise the bar without becoming a blocker
• Curiosity about emerging AI/LLM threat classes and how to defend against them as the product evolves
• Strong command of the vulnerability classes that cause incidents and how to eliminate them at the source — code, API, and authz design
• Nice to have: Consumer product at scale, secure-by-design work on generative-AI or ML product surfaces, and/or early security-hire experience
• This role requires working onsite at one of our three offices
• Applicants must be eligible to work in the US