Whatnot Verified
E-commerce, Live Streaming, Social Commerce, Marketplace
Application Security Engineer
DublinHybridFull TimePosted 1 month agoHidden Gem · YC Startup
Required skills
- Python
- Elixir
- JavaScript
- threat modeling
- security reviews
- vulnerability triage
- bug bounty program
- security releases
- automated tooling
Nice to have
- web applications
- mobile applications
Role summary
Whatnot is seeking an Application Security Engineer to join their remote co-located team. This role focuses on protecting the company's products and systems by partnering with engineering teams to identify risks, resolve vulnerabilities, and build security into the software development lifecycle. Responsibilities include performing security code reviews, threat modeling, vulnerability triage, supporting the bug bounty program, and developing security patterns and automated tooling. The ideal candidate will have 5 years of relevant experience, including software development in Python, Elixir, or JavaScript, and a strong understanding of application security risks. This role requires living within commuting distance of the Dublin hub.
## **🚀 Join the Future of Commerce with Whatnot!**
Whatnot is the largest live shopping platform in North America and Europe to buy, sell, and discover the things you love. Whether it's trading cards, fashion, electronics, or live plants, our sellers are building real businesses across hundreds of categories. We're building live commerce at a scale that's never been done in the West, and there's no playbook to copy. The people here are shaping how an entirely new industry develops.
As a remote co-located team, we're inspired by our [values](https://www.whatnot.com/careers#principles) and anchored in hubs across the US, UK, Ireland, Poland, Germany, and Australia. We move fast, stay close to our users, and focus on the work that drives the most impact.
We're one of the [fastest growing marketplaces](https://www.nytimes.com/2025/10/28/business/dealbook/whatnot-livestream-shopping-fundraise.html) and were recently named the [#1 Best Startup Employer in America](https://www.forbes.com/lists/americas-best-startup-employers/) by Forbes. Check out the latest Whatnot updates on our [news](https://blog.teamwhatnot.com/) and [engineering blogs](https://medium.com/whatnot-engineering) and join us as we enable anyone to turn their passion into a business and bring people together through commerce.
## **💻 Role**
The Application Security Team at Whatnot helps protect the products and systems that buyers and sellers rely on every day. We partner with product and engineering teams to identify risks, resolve vulnerabilities, and build security into how we develop software. Our work spans web and mobile applications, combining hands-on security reviews with reusable patterns and automated tooling that help teams ship securely.
As an Application Security Engineer, you will:
- Perform security-focused code reviews, identifying vulnerabilities and recommending practical fixes.
- Partner with product and engineering teams on threat modeling and application security reviews.
- Help teams reproduce, triage, and address security vulnerabilities in web and mobile applications.
- Support our bug bounty program by investigating reports and working with teams on remediation.
- Support the preparation of security releases.
- Help develop security patterns, processes, and automated tooling that prevent entire classes of security issues.
We offer flexibility to work from home or from one of our global office hubs, and we value in-person time for planning, problem-solving, and connection. Team members in this role must live within commuting distance of our Dublin hub.
## **👋 You**
People who do well at Whatnot tend to be comfortable figuring things out as they go, biased toward action, and genuinely curious about what they're building. They care more about outcomes than credit and stay close to the product and the people using it.
As our next Application Security Engineer, you should have 5 years of relevant experience, plus:
- Software development experience in one or more of Python, Elixir, or JavaScript.
- The ability to review code for security vulnerabilities and work with engineers to implement effective fixes.
- An understanding of application security risks and how to identify them through threat modelling and security reviews.
- The ability to investigate, reproduce, and triage web and mobile application vulnerabilities.
- Strong communication and collaboration skills, with the ability to explain security risks and recommendations clearly to product and engineering teams.
- A practical approach to problem-solving and an interest in building reusable tools and processes that help prevent security issues.
## 🎁 Benefits
- Flexible Time off Policy and Company-wide Holidays (including a spring and winter break)
- Health Insurance options including Medical, Dental, Vision
- Work From Home Support
- Care benefits
- Retirement; 401k offering for Traditional and Roth accounts in the US (employer match up to 4% of base salary) and Pension plans internationally
- Monthly allowance to dogfood the app
- Parental Leave
**Please note: Whatnot will only contact you through official @whatnot.com email addresses. If you see an email impersonating a Whatnot recruiter, please disregard and report it as spam.**
## **💛 EOE**
Whatnot is proud to be an Equal Opportunity Employer. We value diversity, and we do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, parental status, disability status, or any other status protected by local law. We believe that our work is better and our company culture is improved when we encourage, support, and respect the different skills and experiences represented within our workforce.
Whatnot is the largest live shopping platform in North America and Europe to buy, sell, and discover the things you love. Whether it's trading cards, fashion, electronics, or live plants, our sellers are building real businesses across hundreds of categories. We're building live commerce at a scale that's never been done in the West, and there's no playbook to copy. The people here are shaping how an entirely new industry develops.
As a remote co-located team, we're inspired by our [values](https://www.whatnot.com/careers#principles) and anchored in hubs across the US, UK, Ireland, Poland, Germany, and Australia. We move fast, stay close to our users, and focus on the work that drives the most impact.
We're one of the [fastest growing marketplaces](https://www.nytimes.com/2025/10/28/business/dealbook/whatnot-livestream-shopping-fundraise.html) and were recently named the [#1 Best Startup Employer in America](https://www.forbes.com/lists/americas-best-startup-employers/) by Forbes. Check out the latest Whatnot updates on our [news](https://blog.teamwhatnot.com/) and [engineering blogs](https://medium.com/whatnot-engineering) and join us as we enable anyone to turn their passion into a business and bring people together through commerce.
## **💻 Role**
The Application Security Team at Whatnot helps protect the products and systems that buyers and sellers rely on every day. We partner with product and engineering teams to identify risks, resolve vulnerabilities, and build security into how we develop software. Our work spans web and mobile applications, combining hands-on security reviews with reusable patterns and automated tooling that help teams ship securely.
As an Application Security Engineer, you will:
- Perform security-focused code reviews, identifying vulnerabilities and recommending practical fixes.
- Partner with product and engineering teams on threat modeling and application security reviews.
- Help teams reproduce, triage, and address security vulnerabilities in web and mobile applications.
- Support our bug bounty program by investigating reports and working with teams on remediation.
- Support the preparation of security releases.
- Help develop security patterns, processes, and automated tooling that prevent entire classes of security issues.
We offer flexibility to work from home or from one of our global office hubs, and we value in-person time for planning, problem-solving, and connection. Team members in this role must live within commuting distance of our Dublin hub.
## **👋 You**
People who do well at Whatnot tend to be comfortable figuring things out as they go, biased toward action, and genuinely curious about what they're building. They care more about outcomes than credit and stay close to the product and the people using it.
As our next Application Security Engineer, you should have 5 years of relevant experience, plus:
- Software development experience in one or more of Python, Elixir, or JavaScript.
- The ability to review code for security vulnerabilities and work with engineers to implement effective fixes.
- An understanding of application security risks and how to identify them through threat modelling and security reviews.
- The ability to investigate, reproduce, and triage web and mobile application vulnerabilities.
- Strong communication and collaboration skills, with the ability to explain security risks and recommendations clearly to product and engineering teams.
- A practical approach to problem-solving and an interest in building reusable tools and processes that help prevent security issues.
## 🎁 Benefits
- Flexible Time off Policy and Company-wide Holidays (including a spring and winter break)
- Health Insurance options including Medical, Dental, Vision
- Work From Home Support
- Care benefits
- Retirement; 401k offering for Traditional and Roth accounts in the US (employer match up to 4% of base salary) and Pension plans internationally
- Monthly allowance to dogfood the app
- Parental Leave
**Please note: Whatnot will only contact you through official @whatnot.com email addresses. If you see an email impersonating a Whatnot recruiter, please disregard and report it as spam.**
## **💛 EOE**
Whatnot is proud to be an Equal Opportunity Employer. We value diversity, and we do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, parental status, disability status, or any other status protected by local law. We believe that our work is better and our company culture is improved when we encourage, support, and respect the different skills and experiences represented within our workforce.
Similar roles
- Staff Production EngineerWhatnot · San Francisco, CA · Hybrid
- Revenue Accounting AssociateWhatnot · San Francisco, CA · Hybrid
- Application Security EngineerStrive Health · United States · Onsite
- Sr. Application Security EngineerHims & Hers · Remote · Remote
Application Security Engineer, LeadBooz Allen Hamilton · Colorado Springs, CO · Hybrid
Sr. Application Security EngineerPax8 · Remote · Remote
