Senior Application Security Engineer

About the role

About SpotOn

We’re not just building restaurant tech, we’re giving independent restaurants the tools to compete and win. From our award-winning point-of-sale to AI-powered profit tools, everything we do helps operators boost profit, work smarter, and keep their best people. And every solution is backed by real humans who actually give a sh*t about helping restaurants succeed.

- Named the #1 Restaurant POS by G2 (Summer 2026), based on ratings from real users

- Rated the top-rated point-of-sale (POS) for restaurants, bars, retail, and small businesses by Capterra users

- Awarded Great Places to Work and Built In’s Best Workplaces for multiple years running

We move fast, care hard, and fight for independent restaurant operators to do what they love, and love doing it. If you’re looking to make an impact with heart and hustle, SpotOn is the place for you.

About the Role:

SpotOn's Information Security team is hiring a Senior Application Security Engineer to own and mature our application security program. This role maintains the security scanning pipeline (SAST, DAST, dependency, and secrets detection), leads third-party penetration testing engagements, and drives forward newer initiatives like AI/ML pen testing and threat modeling.

This person will own program measurement and reporting, building the metrics that demonstrate how our AppSec initiatives are performing and translating that into executive-ready reporting for our Head of Security. This includes defining the right metrics, tracking them consistently, and presenting program trajectory in a way leadership can act on.

This is a fully qualified position: you're expected to work independently within established security practices, exercise judgment on findings triage and prioritization, and be a credible technical resource that developers actively want to loop in.

On a daily basis you will:

Program Measurement & Executive Reporting (priority focus)

- Define and own the metrics framework for the AppSec program: what gets measured, why it matters, and how it ties to risk reduction (examples: mean time to remediate by severity, finding density trends over time, scan coverage across the repo portfolio, pen test finding recurrence rate, PR security review adherence).

- Establish baselines for each metric to track program trajectory over time.

- Build recurring reporting (monthly/quarterly cadence) that translates raw data into a narrative leadership can act on.

- Prepare materials for the Head of Security to present to Executive leadership, showing program trajectory and where initiatives are moving the needle.

Vulnerability Management & Tooling

- Own and maintain the AppSec scanning stack: SAST, DAST, dependency (SCA), and secrets detection across the repo portfolio.

- Ensure findings from all scanners display accurately in inventory system for engineering visibility.