Application Security Engineer

About the role

Nintendo of America

Summary

This role is part of the IT: Information Security department at Nintendo of America (NOA) and provides hands-on application and AI security engineering for enterprise applications, APIs, cloud services, and AI-enabled solutions. Partners with developers to assess risks, improve secure designs, and build automated security capabilities across the software development lifecycle.

Description of Duties

• Application Security
• Performs security assessments, threat modeling, architecture reviews, and secure code reviews for enterprise applications, APIs, and cloud services.
• Evaluates authentication, authorization, data protection, secrets management, and other application controls; partners with developers to prioritize and validate remediation.
• Develops reusable secure design patterns and provides practical secure coding guidance throughout the software development lifecycle.
• Supports investigation and remediation of application and API security incidents.
• AI Security
• Assesses AI-enabled applications, including large language models (LLMs), retrieval-augmented generation (RAG), agents, and connected tools or Model Context Protocol (MCP) integrations.
• Identifies and helps mitigate prompt injection, sensitive information disclosure, insecure output handling, excessive permissions, and unsafe tool use.
• Partners with application, cloud, and AI teams to implement least privilege, data protection, security testing, and technical guardrails; translates emerging threats into practical recommendations.
• Establishes security review criteria for new AI use cases, including data classification, data handling, model and vendor risk, and approval conditions aligned with AI governance processes and frameworks such as NIST AI RMF and OWASP guidance for LLM applications.
• Reviews identity, access, and logging for AI agents, service accounts, and connected tools, ensuring agent actions are authorized, observable, and auditable.
• Partners with peer security engineers to define detection and response for AI-related threats.
• Security Engineering & Automation
• Builds and integrates security testing into CI/CD pipelines and developer workflows, including static and dynamic testing, dependency analysis, secrets detection, and API testing.
• Develops scripts, tools, and integrations to streamline vulnerability analysis, remediation tracking, and repeatable security processes; evaluates responsible uses of AI to improve these capabilities.
• Maintains and troubleshoots security solutions, evaluates new technologies, and ensures work aligns with established compliance requirements and internal controls.
• Participates in 24x7 on call cycle to support and troubleshoot products and solutions in multiple environments

Summary of Requirements

• Minimum of five (5) years of related experience in application security, security engineering, software engineering, or a related technical security discipline.
• Experience with application assessments, threat modeling, architecture reviews, secure code reviews, and common application vulnerabilities and defenses.
• Understanding of web applications, APIs, cloud services, authentication, authorization, secrets management, and data protection. Ability to read application code; experience with security testing tools, CI/CD pipelines, and automated security checks.
• Strong communication skills, including translating technical risks into clear recommendations for technical and non-technical audiences.
• Foundational understanding of generative AI (ex. CoPilot, Claude), LLM-enabled applications, and related security risks, or demonstrated ability to develop that knowledge quickly.
• Experience with cloud platforms (AWS), API penetration testing, microservices, containers (Kubernetes), in multi-team enterprise environments.
• Familiarity with AI risk and governance frameworks and common AI threats (ex. OWASP), such as prompt injection, data leakage, model or supply chain compromise, and misuse of autonomous agents preferred. Practical AI security experience preferred.
• Experience with Python or another scripting language preferred.
• Undergraduate degree in Computer Science, Cybersecurity, Software Engineering, a related field, or equivalent combination of education and experience.
• Applicants must be legally eligible to work in the United States to be considered. Visa sponsorship is not available for this role.

Additional information

This position is hybrid in Redmond, WA. Hybrid positions require regular onsite work following the schedule and guidelines for their division. This position is not open to fully remote status at this time.

Pay and benefits

This position includes the base pay range listed below, potential for a semi-annual discretionary performance bonus, and a comprehensive benefits package that includes medical, dental, vision, 401(k), and paid time off.

Pay Range

$108,450 - $173,550 USD