Staff Appsec Engineer

Being a Champion for SMBs is good for business. And a career defining opportunity for you

BILL is a leader in financial automation software for small and midsize businesses (SMBs). As a champion of SMBs, we are dedicated to automating the future of finance so businesses can thrive. Hundreds of thousands of businesses trust BILL solutions to manage financial workflows, including payables, receivables, and spend and expense management. With BILL, businesses are connected to a network of millions of members, so they can pay or get paid faster. Through our automated solutions, we help SMBs simplify and control their finances, so they can confidently manage their businesses, and succeed on their terms. 

BILL is a trusted partner of leading U.S. financial institutions, accounting firms, and accounting software providers. We have operations in San Jose, CA, Draper, UT, Houston, TX and Sydney, AUS and are continuing to expand into other geographic locations. If you’re looking for a place that helps you do the best work of your career, look no further than BILL.

This position can be  based either San Jose;  Draper; or  Houston  We support a  hybrid work environment with on-site and remote work days.

Make your impact within a rapidly growing Fintech Company

The Product Security team that is responsible for protecting the internal and external facing applications /API of Bill. The team works closely with the engineering and technical operations teams to identify, track and mitigate security vulnerabilities in applications . 

We’d love to chat if you have:

•  Minimum of 5+ years of experience in Application Security.
• 2-4 years of experience with SAST tools.
• Strong knowledge of web application security ( Good knowledge of all topics covered
• in OWASP Top 10)
• ○ Authentication (SSO, MFA)
• ○ Authorization (Oauth)
• Familiar with Penetration Testing using Burp Suite.
• Knowledge of bot detection / bot prevention tools
• Familiarity with AWS IAM / Security.
• Good working knowledge of Cryptography
• Experience with SAST tools (Veracode, Checkmarx, Coverity)
• Experience with Qualys,Nessus or scanning tools.
• Threat Modeling.
• Working knowledge of Java/Javascript
• Familiar with API usage and authentication of APIs.
• Good understanding of network security, infrastructure security, identity and access
• management, and operating system
•  Professional certification such as GCIH/GCFA/CEH/CHFI/CISSP is desirable.

Let’s talk about benefits

• 100% paid employee health, dental, and vision plans (choose HMO, PPO, or HDHP)
• HSA & FSA accounts 
• Life Insurance, Long & Short-term disability coverage
• Employee Assistance Program (EAP)
• 11+ Observed holidays and wellness days and flexible time off 
• Employee Stock Purchase Program with employee discounts
• Wellness & Fitness initiatives
• Employee recognition and referral programs
• And much more