Sr. Security Engineer

ButterflyMX Inc.

Job Overview

Location

US Remote

Job Type

Full-time

Full Job Description

📋 Description

• As a Senior Security Engineer at ButterflyMX, you will drive application security across the full software development lifecycle, ensuring that security is embedded from design through deployment to protect the company’s property access platform used by over 20,000+ properties worldwide.
• You will lead threat modeling, secure code reviews, and penetration testing; operate and improve SAST/DAST/SCA tooling; manage the vulnerability lifecycle; develop secure coding standards; integrate security into CI/CD pipelines; and partner with product and engineering teams to build security in from the start.
• You will join a distributed, primarily remote team of intelligent, passionate, and collaborative individuals at ButterflyMX, a company committed to delighting customers, taking ownership, fostering collaboration, speaking up, thinking big while doing small, and being tenacious in its mission to automate property access, operations, and security.
• In this role, you will have the opportunity to shape the security program as an early senior hire, report directly to the CISO, leverage AI tools to enhance threat modeling and vulnerability triage, and grow your expertise in application security, cloud security, and secure DevOps practices while making a tangible impact on product safety and customer trust.

🎯 Requirements

• 5+ years of experience in application security with hands-on proficiency in secure development lifecycle practices and offensive testing
• Strong understanding of web application and API security fundamentals (OWASP, MITRE, CIS, API-specific attack surfaces)
• Experience operating SAST/DAST/SCA ASPM tools
• Fluency in scripting or development languages (Python, JavaScript, Go, Ruby, or similar) sufficient to review code and write internal tooling
• Experience designing and executing penetration tests against modern web and mobile applications
• Familiarity with cloud security (AWS preferred, some GCP and OVH) and container/Kubernetes security
• Comfortable in a regulated environment (e.g., SOC 2 or similar)
• Excellent written and verbal communication skills; able to translate technical risk to non-technical stakeholders
• Relevant certifications a plus: OSCP, GWAPT, GPEN, CEH, or equivalent
• Proven experience with leveraging AI tools in both professional and personal settings

🏖️ Benefits

• Comprehensive Medical, Dental and Vision plans (ButterflyMX covers 80% of the cost) starting day 1
• 401(k) plan with a match
• 10 paid holidays, 20 vacation days, 5 sick days, 3 floating holidays
• Basic Life and Accidental Death and Dismemberment Insurance (ButterflyMX covers 100% of the cost)
• Short and Long Term Disability (ButterflyMX covers 100% of the cost)
• Paid Family Leave
• Employee Assistance Program
• Quarterly self-care stipends
• Access to optional benefits including pre-tax flexible healthcare spending accounts (FSA and HSA), Dependent Care FSA, and Commuter Benefits, as well as optional Supplemental Life, AD&D, Hospital Indemnity, Legal, Accident, Critical Illness, Pet, and Personal Liability Insurance

Skills & Technologies

Python

JavaScript

Ruby

AWS

GCP

Senior

Remote

Ready to Apply?

Apply Externally

You will be redirected to an external site to apply.

AI Job Fit Analysis

Pro

See exactly how your profile matches this role — strengths, skill gaps, and what to do about them.

ButterflyMX Inc.

Visit Website

About ButterflyMX Inc.

ButterflyMX Inc. provides cloud-based access control and intercom systems for multifamily, commercial, and student housing properties. Its platform replaces legacy intercoms with smartphone-based entry, supports video calling, delivery PINs, and integrations with property management software. Founded in 2014, the company serves over 10,000 properties across North America.

View Company Profile

Get more remote jobs like this

Subscribe to the weekly newsletter for similar remote roles and curated hiring updates.

Weekly remote jobs and featured talent.

No spam. Only curated remote roles and product updates. You can unsubscribe anytime.