Staff Application Security Engineer

Samsara's Application Security team covers an unusually broad estate: cloud services, internal corporate systems, and firmware running on IoT hardware installed in customer vehicles and sites. This staff level post sets the technical direction for application security and takes ownership of the vulnerability management programme across all of it. The role is remote within the UK, and candidates need to sit in a central or eastern time zone.

What you would work on - Shaping the strategy behind vulnerability management and steadily improving how the programme runs - Owning mean time to remediate as a metric and working the outstanding backlog down - Writing automation and tooling that surfaces vulnerabilities across cloud accounts, device firmware and corporate IT - Translating leadership priorities into architectural choices and realistic delivery plans - Getting fixes actually shipped by working alongside the engineering teams who own the affected code - Joining investigations when a high profile vulnerability lands, and covering on-call for urgent response

What they are looking for - Roughly a decade or more in cloud or security engineering, including hands-on vulnerability management across several products in an enterprise setting - Working proficiency in Go, Python and JavaScript - A track record of setting direction and driving remediation across teams you have no authority over - Familiarity with current vulnerability management tooling and with CVSS and EPSS scoring - Strong AWS grounding plus a solid grasp of SAST, DAST and SCA techniques - Practical experience folding AI and LLM tooling into security workflows - Willingness to mentor engineers on secure design and to explain risk clearly to engineering leadership

Stack: Go, Python, JavaScript, AWS, AWS Lambda, Wiz, Semgrep, Tines, SAST, DAST, SCA, CVSS, EPSS, FedRAMP