Staff II - Application Security Engineer

About this role

Job Description:

Application Security Engineer – Staff 2

Primary Locations - Hybrid 3 days in office in either Atlanta, GA or Mountain View, CA

Can be open to fully remote individuals who are located in the United States if they meet all qualifications of the role.

We are Omnissa!  Omnissa is the first AI-driven digital work platform, built to support flexible, secure, work-from-anywhere experiences. We integrate industry-leading solutions—including Unified Endpoint Management, Virtual Apps and Desktops, Digital Employee Experience, and Security & Compliance—into a seamless, autonomous workspace that adapts to how people work. Our platform boosts employee engagement while optimizing IT operations, security, and cost. Guided by our Core Values—Act in Alignment, Build Trust, Foster Inclusiveness, Drive Efficiency, and Maximize Customer Value—we’re growing rapidly and committed to delivering meaningful impact. If you’re passionate about shaping the future of work, we’d love to hear from you.

What is the opportunity?: This is a senior, hands-on technical leadership role on our Product Security team. As a Staff 2 Application Security Engineer, you will set the technical direction for how we secure software across Omnissa’s product portfolio — spanning Unified Endpoint Management, Virtual Apps and Desktops, and our cloud-native and mobile platforms. You will operate as a force multiplier: influencing architecture and engineering decisions across multiple teams, raising the security bar for the broader organization, and tackling the hardest, most ambiguous problems where the right answer isn’t yet defined. This is a technical leadership track and does not include direct people management; your impact comes through expertise, influence, and the standards you set for others. If you have an analytical mind, a passion for software security, and thrive on solving hard problems, this role is for you. A successful candidate handles a variety of difficult challenges, manages their time efficiently, solves problems creatively, and can identify and understand root causes.

Key Responsibilities:

Security Architecture & Threat Modeling • Set technical direction for application security across the portfolio — defining standards, patterns, and guardrails adopted by engineering teams at scale. • Lead threat modeling across distributed, cloud-native, and mobile architectures as a repeatable practice embedded in the development lifecycle, not a one-off exercise. • Define security architecture reference designs that, when followed by engineering teams, remove the need to security-review that aspect on a per-feature basis. • Identify architectural risk early and influence roadmap and design decisions before implementation begins.

Secure Code Review & Vulnerability Research • Perform manual code review and application security testing across Java and C++ codebases; codify findings into reusable guidance engineers can act on without follow-up. • Scale code review coverage using AI-assisted analysis and custom CodeQL queries tuned to Omnissa's codebase and vulnerability patterns. • Conduct variant analysis to ensure confirmed vulnerability classes are remediated consistently across the codebase, not in isolation. • Triage and validate externally reported vulnerabilities — assess exploitability, severity, and business impact, and drive remediation to closure across team boundaries. • Translate individual findings into systemic recommendations that address root-cause design or implementation gaps across products.

Security Program Maturity • Define and evolve the SDL — identify gaps, drive measurable improvements, and own the iteration cycle. • Improve the feature security review program so security work shifts left into design and scales across teams, rather than landing as a release gate. • Mature the product penetration testing program — define scope, methodology, and cadence; ensure findings drive systemic fixes, not one-off patches. • Build and scale the security champions program; mentor engineers and create training that extends security capability beyond the security team. • Establish metrics that make program effectiveness visible to engineering and product leadership.

What success looks like: • First 3 months: Build a deep understanding of the product architecture, development toolchain, and release process across multiple product areas. Begin influencing in-flight architectural and design decisions, and identify the highest-leverage gaps in the current security program. • First 6 months: Own the security strategy for a significant area of the portfolio. Set direction that other engineers execute against, drive cross-team prioritization of security work, and shape backlog and roadmap decisions. Iterate improvements on the current SDL. • 12 months and beyond: Deliver measurable, org-level improvements in security posture — e.g., materially reduced mean time to remediation, broadened threat model coverage, or new automation adopted in production across teams. Be recognized as a go-to technical authority on application security and a multiplier of the team’s overall effectiveness.

Leadership and team culture: • Report to the Director of Product Security and take technical direction from the Manager of Application Security, while operating with a high degree of autonomy. • Work closely with a committed team of security engineers, product managers, and developers focused on innovation and getting things done. • Build trust among team members and stakeholders, committing to customer success. • Operate in a transparent, communicative environment that emphasizes work-life balance and having fun at work. • Identify and drive improvements to security processes - both internal workflows and partner-facing interfaces - that reduce friction for development teams and increase the daily effectiveness of security engineers.

What will you bring to Omnissa? Required: • 12+ years of hands-on application security expe

Similar jobs

• Senior Application Security Engineer II — Springhealth66 · Remote
• Application Security Engineer II — Abnormalsecurity · Remote
• Staff Application Security Engineer — Censys · Remote
• Staff Application Security Engineer — Brex · Remote
• Staff Application Security Engineer — Thenuclearcompany · Washington, DC
• Staff Application Security Engineer — Gemini · New York, New York; Miami, Florida; Remote (USA)
• Staff Application Security Engineer — Datadog · Boston, Massachusetts, USA; Connecticut, USA, Remote; Delaware, USA, Remote; District of Columbia, USA, Remote; Maryland, USA, Remote; Massachusetts, USA, Remote; New Jersey, USA, Remote; New York, New York, USA; New York, USA, Remote; Rhode Island, USA, Remote
• Staff Application Security Engineer — Ironcladhq · San Francisco