Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted today

Sr. Application Security Engineer

extraspace597 open roles

Where
Salt Lake City, UT, United States
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSr. Application Security Engineerextraspace · Salt Lake City, UT, United States

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on extraspace's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.7% of postings close within 7 days. Measured by our own scanner across the market. extraspace postings stay open a median of 12 days.

Share of postings closed within
  1. 2.2%1 day
  2. 4.5%3 days
  3. 12.7%7 days
  4. 20.4%14 days
  5. 35.6%30 days
  6. 58.7%60 days
This job: posted today

extraspace median: 12 days open

The posting

*** Please note that this is a HYBRID role, requiring this person to work at our Cottonwood Heights office in SLC two days a week. We are not able to provide work sponsorship (i.e. OPT, STEM-OPT or H-1B visa) for this role ***

As a Sr. Application Security Engineer at Extra Space, you'll be a trusted security partner embedded in how our engineering teams design, build, and ship software. You'll work across our Product Engineering org alongside principal and staff engineers, the cybersecurity team, and a security champion on every engineering team, building security in from the start. Our applications run on AWS and Vercel. They're built mostly with C# .NET, TypeScript, and React/Next.js, backed by SQL Server and other relational and non-relational databases.

Duties & Responsibilities

  • Conduct security architecture and design reviews for new and evolving features, surfacing risk early and recommending practical mitigations.
  • Perform threat modeling and manual and automated code reviews, and partner with developers to prioritize and remediate what you find.
  • Drive a risk-based approach to application security, helping teams understand vulnerabilities in terms of business impact.
  • Mature our Secure SDLC, including secure coding standards, security requirements, and automated checks (SAST, DAST, SCA, secrets scanning) in our CI/CD pipelines.
  • Build and maintain security tooling and automation that scales across teams, with a focus on reducing risk rather than adding tools.
  • Lead and grow the security champions program, training champions so each team has security expertise close at hand.
  • Serve as the application security subject matter expert for engineering, product, and leadership, and mentor engineers on secure development practices.
  • Make sure AI tools and AI-powered features are adopted within acceptable risk limits.
  • Align our applications with SOC 1, SOX, CIS v8, and PCI DSS (SAQ-A, SAQ-P2PE), and support audits with evidence and remediation plans.

Requirements

  • 6+ years of combined experience in software engineering, application security, product security, or a closely related field.
  • Proficiency in most of our primary languages (C# .NET, TypeScript, JavaScript, SQL).
  • Experience securing web applications built on modern frameworks and cloud-native architectures, particularly AWS.
  • Hands-on white-box testing and secure code review experience.
  • Strong understanding of SSDLC principles and experience implementing or maturing secure development programs.
  • Solid understanding of common vulnerabilities and attack techniques (OWASP Top 10, API security, authentication and authorization flaws).
  • Experience integrating security tooling into delivery pipelines (GitHub, TeamCity, or similar).
  • Familiarity with AI security risks and emerging attack surfaces, including agentic systems, MCP, and LLM-powered workflows.
  • A risk-focused mindset: you can explain security risk in business terms, weigh it against the business's needs and risk tolerance, and help teams make pragmatic decisions without security theater.
  • A proven ability to build trusted relationships with engineering teams and guide behavior without direct authority.
  • Strong written and verbal communication, equally comfortable in a design review with engineers and a risk conversation with leadership.

Preferred Qualifications

  • Development experience with Next.js, Vercel, or serverless architectures.
  • Practical knowledge of security frameworks and standards such as OWASP ASVS, NIST 800-53, CIS v8, PCI DSS, or SOX.
  • Hands-on security certifications such as OSCP, BSCP, GWEB, PNPT, or similar.
  • Experience running or triaging a bug bounty program.
  • Bachelor's degree in Computer Science, Information Security, or a related field.

Work Environment & Physical Requirements Performs sedentary work in an office environment with limited lifting (less than 10 pounds) or walking required. Close visual acuity required to perform work at computer terminal. No exposure to adverse environmental conditions. Requires repetitive typing motion, talking, hearing, grasping and feeling.

Disclaimer The job description outlines the general nature and scope of work employees perform in this role. It's not intended to be an exhaustive list of all duties, responsibilities, or qualifications required for the position. The company reserves the right to modify, revise, or update the job description to meet business needs.

If you are a current Extra Space employee, please apply through Jobs Hub in Workday.

We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.

Applications Deadline: Applications will be accepted until the position is filled.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against extraspace's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on extraspace's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    extraspace's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.