Security Engineer - Vuln Management (Code)
Replit
Security Engineer - Vuln Management (Code) at Replit is a full time role based in Remote · Foster City, California, USA (remote). The listing states pay of $210k–$270k. It was published on 20 May 2026 and was open at last check.
| Role | Security Engineer - Vuln Management (Code) |
|---|---|
| Company | Replit |
| Location | Remote · Foster City, California, USA (remote) |
| Employment type | Full Time |
| Pay (as listed) | $210k–$270k |
| Published | 20 May 2026 |
| Status | Open at last check |
Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation.
About the Role
We are seeking a mid-level AppSec Vulnerability Management Engineer with a strong software development background. In this role, you will bridge the gap between security, compliance, and engineering teams. You will identify application vulnerabilities, maintain software supply chain security, and drive tracking to satisfy strict regulatory compliance frameworks. You will also serve as a technical responder during security incidents, deploying real-time countermeasures to protect our software ecosystem.
What You'll Do
Core Responsibilities
- Vulnerability Scanning & Triage: Perform periodic application security scanning activities. Review results and prioritize flaws based on CVSS scores, real-world exploitability, and system exposure.
- Compliance-Driven Tracking: Track, document, and manage vulnerabilities according to strict compliance SLAs (e.g., SOC 2, ISO 27001, PCI-DSS). Maintain audit-ready evidence of remediation timelines and exception approvals.
- Executive Reporting & Alerting: Escalate and report critical exposures directly to the CISO and senior leadership. Maintain dashboards and alerting mechanisms that visualize vulnerability status, risk trends, and compliance posture.
- Software Supply Chain Security: Ownership of the organization's Software Bill of Materials (SBOM). Continually update SBOM inventories to ensure compliance with modern regulatory requirements and dependency tracking. Help Replit mature through various SLSA levels for supply chain security.
- Remediation Collaboration: Partner with development teams to provide clear mitigation paths. Review, write, and patch code directly when necessary to resolve security flaws.
- Tooling Integration: Configure and tune automated security testing tools within CI/CD pipelines to reduce false positives for engineering teams.
- Incident Response Support: Assist Incident Response teams during active breaches or security incidents. Help develop and implement immediate, real-time code or infrastructure countermeasures.
Required Skills & Experience
- Experience: 5 years of experience in Application Security, DevSecOps, or Software Engineering roles.
- Development Background: Solid foundational experience working in a software development capacity.
- Code Literacy: Ability to read, understand, and safely patch security flaws in JavaScript/TypeScript, Python, and Go.
- Build System Expertise: Strong familiarity with build systems, package managers, and compilation workflows across multiple languages and frameworks.
- AppSec Tooling Expertise: Hands-on experience operating SAST, SCA, and Secret Scanning tools (such as Snyk, Socket, Wiz Code, Semgrep, or Checkmarx).
- Compliance Awareness: Understanding of how vulnerability management maps to security compliance frameworks like SOC 2, ISO 27001, or NIST.
What We Value
- Systems Thinking: The ability to see the "big picture" and understand how security decisions impact the entire stack.
- Technical Influence: The ability to drive technical alignment across the organization through expertise and collaboration rather than direct authority.
- Autonomy: Comfortable leading major technical initiatives and driving outcomes with minimal oversight.
- Problem-Solving Mindset: A passion for breaking down complex security challenges into elegant, scalable engineering solutions.
This is a full-time role that can be held from our Foster City, CA office. The role has an in-office requirement of Monday, Wednesday, and Friday.
Full-Time Employee Benefits Include:
💰 Competitive Salary & Equity
💹 401(k) Program with a 4% match (US Only)
⚕️ Health, Dental, Vision and Life Insurance
🩼 Short Term and Long Term Disability
🚼 Paid Parental, Medical, Caregiver Leave
🏝 Flexible Time Off (FTO) + Holidays
🚗 Commuter Benefits (In-Office Only)
📱 Monthly Wellness Stipend
🧑💻 Autonomous Work Environment
🖥 In Office Set-Up Reimbursement (In-Office Only)
🚀 Quarterly Team Gatherings
☕ In Office Amenities (In-Office Only)
Want to learn more about what we are up to?
Interviewing + Culture at Replit
To achieve our mission of making programming more accessible around the world, we need our team to be representative of the world. We welcome your unique perspective and experiences in shaping this product. We encourage people from all kinds of backgrounds to apply, including and especially candidates from underrepresented and non-traditional backgrounds.
Create your free OnJob profile to apply — we'll take you to Replit's application after sign-up. · Posted 20 May 2026.
Security Engineer - Vuln Management (Code) at Replit — questions answered
What does the Security Engineer - Vuln Management (Code) role at Replit pay?
The Security Engineer - Vuln Management (Code) at Replit listing states pay of $210k–$270k for the Remote · Foster City, California, USA (remote) position. That figure is taken directly from the employer's own posting as published, not estimated or averaged from other roles.
Is the Security Engineer - Vuln Management (Code) role at Replit remote?
Yes — Replit advertises this Security Engineer - Vuln Management (Code) role as remote, tied to Remote · Foster City, California, USA, and it is listed as full time work. Remote terms come from the employer's own posting, so confirm the expected working hours, timezone and any on-site days with Replit before you apply.
Is the Security Engineer - Vuln Management (Code) role at Replit still open?
The Security Engineer - Vuln Management (Code) posting at Replit was open at OnJob's last check of the employer's careers page, having been published on 20 May 2026. OnJob re-checks source listings on each build and marks a role closed once it disappears, but listings can close without notice, so the employer's own page is the final word.
How do you apply for the Security Engineer - Vuln Management (Code) role at Replit?
Apply to the Security Engineer - Vuln Management (Code) at Replit role through OnJob with a free profile: OnJob scores your fit against the listing, shows the skills lowering that score, and submits an ATS-ready profile to Replit's own application page. Creating a profile is free and needs no card.
Related Engineering jobs
Hand-picked roles that match this listing on skills, category and location — each scored to your profile inside OnJob.
Explore more on OnJob
Hiring for a role like this?
Post a job on OnJob and reach AI-matched candidates.