---
title: 'Application Security Engineer at VGS'
canonical: 'https://feeny.ai/job/application-security-engineer-vgs-united-states-7hx7ew6h3nsp'
type: 'job'
last_seen: '2026-10-18'
---

# Application Security Engineer at VGS

- **Company:** VGS
- **Location:** United States
- **Compensation:** $175k–$230k
- **Employment:** full-time
- **Work type:** remote
- **Posted:** 2026-10-12
- **Last confirmed live:** 2026-10-18
- **Apply:** https://jobs.lever.co/verygoodsecurity/c9dd48c1-c6f9-47b2-b622-c9259b4a1ef6

## Job description

## About VGS

VGS is building the trust infrastructure for a new era of commerce. As commerce becomes agentic, payments are increasing dramatically in volume, speed, and complexity, and the companies driving that shift need a foundation they can fully trust.

That's where VGS comes in. We're the world's leader in payment tokenization, trusted by the most innovative AI and Fortune 500 companies, merchants, banks, and fintechs to power modern payments and agentic commerce. We store more than 9 billion tokens and process more than 10 billion monthly interactions, touching a third of all e-commerce. That scale isn't incidental. It's why leading companies embed our universal token vault and credential management platform directly into their stack, taming the complexity of payment data so they can move faster.

Come build the platform that enables modern payments for the world's largest companies. We're helping businesses unlock new possibilities in an industry that never stops moving. And that takes exceptional people.

## About the Role

As an Application Security Engineer, you will partner directly across Security and Engineering to build a friction-free, developer-centric security program. You will shape our Secure SDLC, automate security guardrails in our CI/CD pipelines, scale our private bug bounty program, and foster a strong culture of security champions across a globally distributed team.

- Automate Security Controls: Integrate proactive security tooling (SAST, DAST, SCA) directly into CI/CD pipelines (GitHub/GitLab) to catch vulnerabilities before code hits production.

- Define & Drive Secure SDLC: Design, communicate, and maintain developer-friendly SDLC processes, frameworks, and threat modeling practices (e.g., STRIDE).

- Manage Bug Bounty & Triage: Spearhead our private bug bounty program—tracking spends, triaging reports, and lowering Mean Time to Mitigation (MTTM).

- Build Engineering Capability: Share best practices through secure coding training and cultivate a Security Champions network across Engineering.

- Lead AppSec Reviews: Conduct threat models and code reviews for Java and Python microservices.

- Amplify Security Culture: Partner with external communications to author technical blogs, manage vulnerability disclosures, and showcase VGS’s security engineering.

## What You Bring

- AppSec Experience: 3–5+ years of dedicated experience in Application Security and/or full stack development, with proven experience .

- Technical Depth: Practical background conducting secure code assessments for Java and Python applications.

- Tooling & Automation: Deep familiarity integrating SAST/DAST tools (e.g., GitHub Advanced Security, ZAP/BURP, Synopsys/Veracode, Semgrep and similar tools) into modern CI/CD systems.

- Vulnerability & Program Management: Hands-on experience operating bug bounty  programs and setting program metrics/KPIs.

- Threat Modeling: Practical experience applying frameworks like STRIDE to complex systems.

- Collaborative Mindset: Exceptional communication skills with a track record of building trust across engineering teams.

Nice to Have:

- BA/BS degree

- A knack for out-of-the-box thinking that thrives in a fast-paced startup environment

- Prior experience in cloud-native, high-growth, or pre-IPO fintech startups.

- Hands-on experience with AWS security controls and cloud infrastructure.

- Comfortable navigating fully remote, globally distributed work environments.’

We're looking for passionate professionals who take pride in their craft and want to help grow a team tackling some of the most critical problems in payments. People who thrive here are curious by nature, unafraid of hard problems, and motivated by the chance to build something that matters at scale.

If you're driven to make a meaningful impact, work at the leading edge of payment technology, and grow your career alongside a team that values ownership, collaboration, and continuous learning, you'll feel right at home at VGS.

## About VGS

## Company Overview
- **One-liner**: VGS provides a tokenization and credential management platform that secures sensitive payment data for enterprises, enabling PCI compliance and network value-added services.
- **Entity Type**: Private (Series C)
- **Headquarters**: San Francisco, California, United States
- **Founded**: 2015
- **Founders**: Not publicly available

## Core Business
- Primary industry/industries: Financial Services, Payment Tokenization, Data Security
- Target customers: B2B – Fortune 500 companies, merchants, fintechs, banks, marketplaces, and gaming/hospitality organizations
- Mission or purpose statement: "To transform how sensitive payment data is stored, secured, and used to enable agentic commerce and beyond" [verygoodsecurity.com](https://www.verygoodsecurity.com/about-us)

## Products & Services
- **[Card Management Platform](https://www.verygoodsecurity.com/about-us)**: Composable, single-API platform that unifies Network Tokens, Account Updater, Card Attributes, and 3DS into one card object.
- **[Vault](https://www.verygoodsecurity.com/about-us)**: PCI-compliant secure vault for tokenizing sensitive data (card numbers, PII) so it never touches client systems.
- **[Network Tokens](https://www.verygoodsecurity.com/about-us)**: Randomized codes issued by card networks (Visa, Mastercard, Amex, Discover) that replace PANs to reduce fraud and improve authorization rates.
- **[Account Updater](https://www.verygoodsecurity.com/about-us)**: Direct network integration that continuously updates card-on-file data to reduce failed transactions.
- **[Card Attributes / BIN Lookup](https://www.verygoodsecurity.com/about-us)**: Detailed card metadata (beyond BIN) for fraud prevention and payment optimization.
- **[3DS (Three-Domain Secure)](https://www.verygoodsecurity.com/about-us)**: Security protocol for verifying cardholder identity during online payments.
- **[Account Validation](https://www.verygoodsecurity.com/about-us)**: Card verification, CVC verification, AVS, and ANI services to confirm account ownership and validity.

## Market Standing
- **Valuation/Market Cap**: Not publicly available
- **Key Metric**: Annual Revenue – USD 35,000,000 (LinkedIn estimate) [linkedin.com](https://www.linkedin.com/company/very-good-security)
- **Total Funding**: USD 104,930,000 across 6 rounds [linkedin.com](https://www.linkedin.com/company/very-good-security)
- **Notable Investors/Partners**: Andreessen Horowitz (Series A lead), Goldman Sachs Merchant Banking Division (Series B lead), Vertex Ventures (Series C lead) [linkedin.com](https://www.linkedin.com/company/very-good-security)
- **Growth Signals**: 
  - 45 billion annual interactions processed globally [verygoodsecurity.com](https://www.verygoodsecurity.com/)
  - 7 billion tokens held globally
  - Workforce of 117 employees distributed across 12 countries (including US, Ukraine, Canada, Greece, India)
  - Monthly employee growth of +1.7% [linkedin.com](https://www.linkedin.com/company/very-good-security)

## Competitive Advantages
- One of the few providers with **direct network connections** to card networks (Visa, Mastercard, Amex, Discover), enabling the most up-to-date account information and higher authorization rates [verygoodsecurity.com](https://www.verygoodsecurity.com/about-us)
- **Tokenization-first approach** reduces PCI DSS scope and simplifies compliance for clients
- **Single API** for multiple network value-added services (Network Tokens, Account Updater, Card Attributes, 3DS), reducing integration complexity
- Proven trust with **Fortune 500** organizations and regulated financial institutions

## Strategic Focus
- **Agentic Commerce**: Enabling secure, autonomous transactions where intelligent agents initiate, manage, and optimize payments without exposing sensitive data [verygoodsecurity.com](https://www.verygoodsecurity.com/about-us)
- **Card Management Platform expansion**: Consolidating multiple card services into one interoperable solution
- **Global scalability**: Growing distributed engineering and operations teams to support international clients

## Why Work Here
- **Distributed & flexible**: Remote-first with hybrid options in San Francisco Bay Area; open to candidates across the US and Canada [jobs.lever.co](https://jobs.lever.co/verygoodsecurity)
- **Engineering-centric culture**: 53 out of 117 employees are in technical roles (45%), indicating strong product and engineering investment [linkedin.com](https://www.linkedin.com/company/very-good-security)
- **Impact at scale**: Work on a platform handling 45 billion annual interactions and securing data for the world’s largest enterprises
- **Diverse, international team**: Employees across 12 countries, with significant presence in Ukraine, Canada, Greece, and India
- **Growth opportunities**: Recent headcount growth (+1.7% monthly) and active hiring for roles like Strategic Finance Manager, Staff Accountant, and Senior Manager of Revenue Operations & Analytics

## Sources
1. [verygoodsecurity.com – Homepage](https://www.verygoodsecurity.com/)
2. [verygoodsecurity.com – About Us](https://www.verygoodsecurity.com/about-us)
3. [linkedin.com – VGS Company Page](https://www.linkedin.com/company/very-good-security)
4. [cbinsights.com – VGS Profile](https://www.cbinsights.com/company/very-good-security)
5. [jobs.lever.co – VGS Careers](https://jobs.lever.co/verygoodsecurity)

## Other roles at VGS

- [Senior Technical Recruiter — Contract with Option to Hire](https://feeny.ai/job/senior-technical-recruiter-contract-with-option-to-hire-vgs-united-states-gbm06r4bj9w0) — United States
- [Product Manager, Agentic Commerce](https://feeny.ai/job/product-manager-agentic-commerce-vgs-united-states-8n2qj8d2t6rz) — United States
- [Product Manager, Payment Messaging](https://feeny.ai/job/product-manager-payment-messaging-vgs-united-states-2chjq43qvht7) — United States
- [Staff Software Engineer - DevEx](https://feeny.ai/job/staff-software-engineer-devex-vgs-united-states-bg1mz13kvrb2) — United States
- [Sr. Software Engineer](https://feeny.ai/job/sr-software-engineer-vgs-united-states-wejycd8ym9tj) — United States
- [Sr. Software Engineer](https://feeny.ai/job/sr-software-engineer-vgs-san-francisco-jpwcmp2s496x) — San Francisco, CA
- [Solutions Architect](https://feeny.ai/job/solutions-architect-vgs-united-states-2g1v037vw564) — United States
- [Staff Infrastructure Engineer](https://feeny.ai/job/staff-infrastructure-engineer-vgs-united-states-xbftp83dtw52) — United States
- [Sr. Staff Infrastructure Engineer](https://feeny.ai/job/sr-staff-infrastructure-engineer-vgs-united-states-xy6cxcv7bsr9) — United States
- [Technical Support Engineer](https://feeny.ai/job/technical-support-engineer-vgs-united-states-t9y5qhhxay1b) — United States