Application Security Engineer I

Hybrid

Boston, MAPosted 1 month ago$96,000—$120,000 USDWebsite

Apply on LinkedIn →

At a Glance

2+ years experienceAWSPythonJavaGoKubernetes

About This Role

CarGurus is looking for an Application Security Engineer I to join their growing Security Engineering and Architecture team. This is a hands-on technical role focused on helping secure the applications, products, and infrastructure that power CarGurus. In this role, you will partner with engineers and senior security team members to help review services for security best practices, support vulnerability remediation, and contribute to security guardrails that reduce common application and developer-environment risks. This role is a strong fit for someone early in their security career who is excited to learn application security fundamentals, build practical technical skills, and grow in a collaborative engineering environment.

Responsibilities

Support threat modeling and security risk assessments for CarGurus applications and products
Assist in training developers on secure coding, AI-assisted development, and secure SDLC practices
Help triage, prioritize, assign, and track remediation of vulnerabilities
Contribute to the operation and improvement of code and infrastructure scanning tools and policies that help monitor and enforce security guardrails
Assist in investigations involving application security issues
Partner with development teams and senior security engineers to help design and implement security controls for a cloud-first infrastructure (AWS, Kubernetes, and related technologies)

Requirements

AWSKubernetesCI/CDPythonGoJava

0 to 2 years of experience in cybersecurity, application security, software engineering, or a related technical field
Internship, co-op, academic, or hands-on project experience in security or software development is a plus
Interest in leveraging modern technologies, including AI and ML, to improve security outcomes
Familiarity with application security concepts such as secure coding, vulnerability management, threat modeling, or risk assessment
Familiarity with cloud infrastructure and technologies such as AWS, Kubernetes, containers, or infrastructure as code
Familiarity with standard SDLC processes and engineering tools such as GitHub and CI/CD automation
Familiarity with at least one programming or scripting language such as Python, Go, Java, or a similar language
Strong passion for continuous learning, especially in cybersecurity and technology

Benefits & Perks

Best-in-class benefits and compensation

Equity for all employees, both when they start and as they continue to grow

Career development programs

Corporate giving programs

Employee resource groups (ERGs) and communities

Flexible hybrid model

Robust time off policies

Daily free lunch

New car discount

Meditation and fitness apps

Commuting cost coverage

Discretionary bonuses/incentives

Restricted Stock Units (RSUs)

About CarGurus

CarGurus, Inc. is a leading automotive research and marketplace platform based in Boston, Massachusetts. Founded in 2006, the company aims to enhance trust and transparency in the car-buying and selling process. CarGurus is recognized as the most-visited automotive shopping site in the U.S., operating marketplaces in the U.S., the U.K., and Canada. The company offers a wide range of digital services for consumers, including an extensive online vehicle marketplace with over 5 million listings, deal ratings to help buyers find the best value, and tools for starting the vehicle purchase process online. For auto dealerships, CarGurus provides listing options, digital wholesale solutions, and advertising products to enhance visibility and connect with consumers. Additionally, the company collaborates with automotive manufacturers and financial institutions to offer integrated financing options and brand exposure. CarGurus is committed to making the car transaction experience more efficient and transparent for all users.

Industry

information technology & services

Employees

1,300

296 engineers

Revenue

$939M

Website

Visit →

Security at CarGurus

Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.

3 Intel Signals

Security Philosophy

CarGurus uses organizational, architectural, and operational security measures to protect applications, infrastructure, and customer and visitor data.
It promotes security awareness, data-protection training, and security best practices.
The AppSec role is explicitly collaborative: it partners with engineers, trains developers on secure coding and secure-SDLC practices, and contributes to guardrails intended to reduce application and developer-environment risks.
All critical production changes undergo review, testing, and approval before release.
CarGurus performs regular information-security risk assessments and uses a risk-based approach for periodic access reviews.
Stated goals include reducing common application and developer-environment risks, improving scanning tools and policies, training developers, supporting threat modeling, measuring the AppSec program, and integrating security requirements into business and engineering processes.

Security Team

CarGurus publicly describes a growing, centralized Security Engineering and Architecture team.
The Application Security Engineer I role partners with engineers and senior security personnel on service reviews, vulnerability remediation, and security guardrails.
A Principal Application Security Engineer posting describes reporting to the Director of Information Security.
Current public professional-profile data identifies Michael Anderson as Senior Manager, Security Engineering and Architecture, beginning April 2026.
Team-size estimate as of: 2 explicitly identified Application Security Engineers in public professional-profile data, plus 7 additional named security, security engineering, information security, and security-risk personnel in the broader security organization.
Common skill patterns include threat modeling, risk assessments, vulnerability triage, code and infrastructure scanning, secure-coding training, security guardrails, AWS, Kubernetes, GitHub, CI/CD, Python, Go, Java, and infrastructure as code.

Key Initiatives

CarGurus operates a vulnerability-management program to identify and remediate vulnerabilities, accepts researcher reports through a third-party bug-bounty platform, conducts internal and external testing, and performs periodic external network and web-application penetration testing.
The Application Security Engineer I role includes triaging, prioritizing, assigning, and tracking remediation of vulnerabilities.
Documented activities include threat modeling, security risk assessments, secure-coding training, code and infrastructure scanning policies, service reviews, and review/testing/approval of critical production changes.
The company also performs inventorying of inbound and outbound API traffic, analyzes data flows, and sends anomalies to SIEM and ITSM systems..

Preparing for an AppSec interview?

Get the weekly briefing 2,000+ security pros trust.

Interested in this role?

Apply on LinkedIn