Application Security Engineer

## About the Role We're looking for a high-autonomy Application Security Engineer to help with full-stack security (edge + cloud + app); both defensive and offensive; of our global PaaS platform. This is not a "ticket-driven" role. You are someone who: - Identifies risks before they're reported - Prioritizes based on real-world impact - Takes initiative to protect the platform and our customers You will contribute to our security roadmap end-to-end, balancing platform availability, customer experience, and data protection across a globally distributed infrastructure. ## Responsibilities - Edge Governance & Traffic Analysis: Own the Cloudflare stack. Monitor traffic patterns to identify threats (DDoS, credential stuffing, scraping) and implement real-time countermeasures. You know how to mitigate a threat without shutting down a "big customer." - Cloudflare Mastery: You don't just click toggles; you write Cloudflare Workers and custom WAF expressions to intercept sophisticated L7 attacks before they hit our origin. - Vulnerability Ecosystem (Intigriti): Lead our 3rd-party researcher program. Triage and validate reports, ensuring we reward the first reporter and immediately implement "kills" at the source (e.g., via Cloudflare rules) to stop the noise. You are the bridge between external researchers and our internal dev teams. You move fast to validate, reward, and—most importantly—virtual-patch vulnerabilities at the edge while the permanent fix is escalated to the dev team. - Offensive Strategy & Internal Pen-tests: Proactively identify weaknesses across our systems. Design and execute targeted internal penetration tests. Focus on real-world attack paths. You will identify and escalate flawed business logic. Not checkbox testing. Partner with engineering teams to ensure fixes are implemented effectively. You see the gaps in how the product is designed and advocate for systemic fixes. - Application & Dependency Security: Monitor and respond to vulnerabilities in application dependencies and frameworks (e.g., reviewing alerts from tools like Dependabot and validating real impact). Evaluate real-world impact and prioritize remediation. ## About Donorbox Donorbox is a leading fundraising platform and donor management system for nonprofit organizations. Our mission is to accelerate positive impact worldwide by helping nonprofits become highly effective at raising funds and managing their supporter base. Since 2014, we have powered more than 100,000 global organizations to raise over $3B in donations. 🚀 Our fast-growing company is profitable and bootstrapped with a healthy run rate. We have a fully distributed and diverse 150-person team based in 16+ states and 23+ countries. In 2026, Donorbox was named by Built In as one of the Best Places to Work in Washington, DC. 🏅 Donorbox is rated the #1 software for fundraising, donor management, and nonprofit payment on G2 based on hundreds of verified customer reviews — a reflection of the care our team puts into building products that nonprofits trust.