---
title: 'Security Engineer, Application Security at Quartermaster'
canonical: 'https://feeny.ai/job/security-engineer-application-security-quartermaster-united-states-jv69v1vj0h7m'
type: 'job'
last_seen: '2026-10-14'
---

# Security Engineer, Application Security at Quartermaster

- **Company:** Quartermaster
- **Location:** United States
- **Employment:** full-time
- **Work type:** remote
- **Posted:** 2026-10-13
- **Last confirmed live:** 2026-10-14
- **Apply:** https://jobs.ashbyhq.com/quartermaster/d8948b61-e75e-451e-9fa1-ef856e0e76b3

## Job description

## About Quartermaster AI

At Quartermaster AI, we believe the ocean should be a safe and sustainably managed resource for all. By leveraging cutting-edge AI and robotics, we unlock capabilities that were only recently impossible. Our distributed open-ocean systems enable every vessel to sense, compute, and communicate, enhancing maritime domain awareness for those who need it most. The software we ship runs in contested environments and on systems our partners stake their missions on. We need an application security engineer who can build security into our products from the first design review to the last line of code — making secure the easy, default path for every engineer on the team.

## The Role

As our Security Engineer, Application Security, you will own the security of the software we build — our cloud services, APIs, data pipelines, and the applications that run across our distributed, edge-deployed systems. You will be the security partner engineering teams turn to: leading threat models and design reviews, finding and helping fix vulnerabilities in code, and steering the architecture of our products toward secure-by-default. This is a hands-on senior role with broad autonomy. You’ll go deep on code and architecture, build the tooling and automation that scales application security across a fast-moving engineering org, and raise the security bar through developer enablement rather than gatekeeping. You will work closely with Engineering, our security operations team, and GRC, and help shape the secure software development lifecycle as the company grows.

## Key Responsibilities

- Lead threat modeling and secure design reviews for new and existing services, identifying and mitigating risk early in the development lifecycle.
- Perform in-depth secure code reviews and full-scope application security assessments — whitebox, greybox, and blackbox — across web, API, cloud, and backend services.
- Build, integrate, and tune application security tooling in CI/CD — SAST, DAST, SCA, secret scanning, and static analysis platforms such as CodeQL — to catch vulnerabilities before they ship.
- Triage, prioritize, and drive remediation of application vulnerabilities together with engineering teams, ranking work by real-world risk and business impact.
- Develop automation and paved-road tooling that eliminate entire classes of weaknesses and make the secure path the default path for developers.
- Serve as the application security subject-matter expert for engineers and architects, steering product design toward secure-by-default patterns.
- Define and mature the secure software development lifecycle (SDLC), secure coding standards, and security requirements across the engineering organization.
- Own or support the vulnerability disclosure and bug bounty process — scoping, validating submissions, performing root-cause analysis, and coordinating fixes with engineering.
- Strengthen software supply chain security, including dependency management, artifact and commit signing, and build/pipeline integrity.
- Partner with the security operations team on application-layer incidents, providing code-level expertise during investigation and remediation.
- Deliver developer-focused security training and champion a security-aware engineering culture through enablement rather than gatekeeping.

Required Qualifications

- 5–8 years in application security, product security, or software engineering with a strong security focus.
- Software development experience in one or more modern languages (e.g., Python, Go, Java, JavaScript/TypeScript, Rust, or C/C++) and the ability to read and reason about production code.
- Demonstrated experience evaluating code for vulnerabilities and weaknesses, and leading threat modeling and security design reviews.
- Hands-on experience with application security tooling — SAST, DAST, SCA, and static analysis platforms such as CodeQL — and integrating them into CI/CD pipelines.
- Strong understanding of the OWASP Top 10 (web and API), CWE, common vulnerability classes, and secure coding practices.
- Experience securing modern architectures — microservices/SOA, REST/gRPC APIs, containers, and cloud environments (AWS, Azure, or GCP).
- Experience performing black-box and grey-box testing of web applications and APIs.
- Proven track record driving vulnerability remediation by partnering with engineering teams rather than blocking them.
- Excellent written and verbal communication skills, with the ability to influence engineers and explain risk to both technical and non-technical audiences.
- Must be a U.S. citizen.
- Bachelor’s degree in Computer Science, Cybersecurity, or equivalent hands-on experience.

## Preferred Qualifications

- Active U.S. security clearance, or eligibility and willingness to obtain and maintain one.
- Industry certifications such as OSCP, OSWE, GWAPT, GWEB, CSSLP, or Burp Suite Certified Practitioner.
- Experience building “paved road” / secure-by-default frameworks and developer self-service security tooling.
- Experience with software supply chain security (SLSA, in-toto, Sigstore) and artifact/commit signing.
- Experience with infrastructure-as-code and cloud-native security (Terraform, Kubernetes).
- Contributions to bug bounty programs, published CVEs, security research, or open-source security tooling.
- Familiarity with securing embedded, edge, or robotics/IoT software.
- Familiarity with defense-sector compliance frameworks (NIST 800-171, CMMC) as they relate to secure development.
- Prior experience in a startup, defense, intelligence, or critical-infrastructure environment.

Why Join Quartermaster AI?

- Build application security from the ground up for a company defending critical maritime and national-security infrastructure.
- Work with cutting-edge AI and robotics systems in real-world, high-stakes environments.
- Significant autonomy to shape the secure SDLC, tooling, and standards the entire engineering org builds on.
- Competitive salary with comprehensive medical, dental, and vision benefits.
- Flexible remote work with a mission-driven, fast-moving team.
- Career growth in a rapidly scaling defense-tech company at the forefront of maritime AI.

## About Quartermaster

## Company Overview
- **One-liner**: Quartermaster builds a real-time, distributed maritime awareness network by equipping vessels with AI-powered sensor packages (SmartMast) and an analytics platform.
- **Entity Type**: Private (Series A)
- **Headquarters**: Arlington, Virginia, United States
- **Founded**: 2023
- **Founders**: Neil Sobin (CEO)

## Core Business
- **Primary industry**: Maritime intelligence, defense technology, AI/robotics, ocean sensing
- **Target customers**: Governments (navies, coast guards), commercial shipping operators, insurers, and maritime researchers (B2G, B2B)
- **Mission**: “Connect every vessel on the water to create a comprehensive, real-time picture of our oceans, unlocking critical data insights that underpin a prosperous global maritime ecosystem.” [quartermaster.us](https://www.quartermaster.us/about)

## Products & Services
- **SmartMast**: A weather-hardened hardware package (cameras, radios, sensors) mounted on a ship’s mast that continuously collects and relays maritime data. Combined with an AI analytics platform, it provides real-time vessel identification, anomaly detection, and environmental monitoring. [techcrunch.com](https://techcrunch.com/2026/05/20/this-startup-raised-43m-to-build-a-hive-mind-for-ships/)
- **Quartermaster Analytics Platform**: Cloud-based software that ingests SmartMast data and applies computer vision and machine learning to generate actionable intelligence for fleet operators, insurers, and government agencies.

## Market Standing
- **Valuation/Market Cap**: Not disclosed
- **Key Metric**: $43 million in Series A funding (announced May 20, 2026) [techcrunch.com](https://techcrunch.com/2026/05/20/this-startup-raised-43m-to-build-a-hive-mind-for-ships/)
- **Notable Investors/Partners**: Co-led by First Round Capital and Quiet Capital, with participation from TMV, Steel Atlas, BoxGroup, Operator Partners, Shorewind Capital, and David (surname not specified). Key hires from Anduril (Steve Ribaudo as CGO) and Scale AI (Matt Beck as COO). [quartermaster.us](https://www.quartermaster.us/about) | [linkedin.com](https://www.linkedin.com/company/quartermasterai)
- **Growth Signals**:
  - Headcount grew 625% year-over-year to 40 employees (as of mid-2026). [linkedin.com](https://www.linkedin.com/company/quartermasterai)
  - Over 600 ships equipped with SmartMast, covering 10 million square miles of ocean. [techcrunch.com](https://techcrunch.com/2026/05/20/this-startup-raised-43m-to-build-a-hive-mind-for-ships/)
  - Assisted in “over 20 rescues of mariners at sea.” [techcrunch.com](https://techcrunch.com/2026/05/20/this-startup-raised-43m-to-build-a-hive-mind-for-ships/)
  - Operates in 7 countries (Panama, Colombia, South Korea, UAE, Brazil, Taiwan, United States). [linkedin.com](https://www.linkedin.com/company/quartermasterai)

## Competitive Advantages
- **Proprietary hardware edge**: SmartMast is far more advanced than the standard AIS (Automatic Identification System), which is opt-in and easily spoofed. Quartermaster’s sensors provide persistent, verified, real-time data that is less susceptible to fraud. [techcrunch.com](https://techcrunch.com/2026/05/20/this-startup-raised-43m-to-build-a-hive-mind-for-ships/)
- **Pro-mariner incentive model**: Rather than selling sensors to fleet operators (a tough sell in a low-margin industry), Quartermaster creates value for mariners (e.g., rescue support, safety data) to encourage voluntary adoption, locking in network effects. [techcrunch.com](https://techcrunch.com/2026/05/20/this-startup-raised-43m-to-build-a-hive-mind-for-ships/)
- **First-mover in distributed ocean sensing**: No other company has deployed a real-time, AI-powered sensor constellation at this scale, giving Quartermaster a data moat and early relationships with governments and commercial fleets.

## Strategic Focus
- **Engineering hiring**: A large portion of the $43M Series A is earmarked for hiring engineers (RF, software, AI, systems) to accelerate product development. [techcrunch.com](https://techcrunch.com/2026/05/20/this-startup-raised-43m-to-build-a-hive-mind-for-ships/)
- **Fleet expansion**: Continue equipping more vessels with SmartMast, especially in key maritime corridors, to densify the network.
- **New applications**: Developing uses for government intelligence, marine autonomy training data, environmental monitoring, and insurance risk assessment.
- **Global presence**: Scaling operations in Latin America, Asia, and the Middle East (already in 7 countries). [linkedin.com](https://www.linkedin.com/company/quartermasterai)

## Why Work Here
- **High-impact mission**: Directly contribute to ocean safety, security, and sustainability – work that has tangible real-world results (e.g., rescues at sea).
- **Fast-growing startup**: 625% YoY headcount growth; employees have significant ownership and influence over product direction.
- **Engineering culture**: “A single engineer can make a significant impact in relatively short periods of time” because the ocean space is largely untapped. [techcrunch.com](https://techcrunch.com/2026/05/20/this-startup-raised-43m-to-build-a-hive-mind-for-ships/)
- **Remote-friendly**: Some roles (e.g., “Opportunity Hire”) are listed as remote, though the HQ in Arlington, VA likely expects hybrid for core engineering teams. [quartermaster.us](https://www.quartermaster.us/jobs/opportunity-hire)
- **Diverse, inclusive environment**: Equal opportunity employer that encourages individuals of all backgrounds to apply. [quartermaster.us](https://www.quartermaster.us/jobs/opportunity-hire)
- **Notable perks**: Not explicitly listed, but the company emphasizes pro-mariner values and a collaborative, mission-driven culture.

## Sources
1. [quartermaster.us/about](https://www.quartermaster.us/about)
2. [techcrunch.com](https://techcrunch.com/2026/05/20/this-startup-raised-43m-to-build-a-hive-mind-for-ships/)
3. [linkedin.com/company/quartermasterai](https://www.linkedin.com/company/quartermasterai)
4. [quartermaster.us/jobs/opportunity-hire](https://www.quartermaster.us/jobs/opportunity-hire)
5. [jobs.ashbyhq.com/quartermaster](https://jobs.ashbyhq.com/quartermaster)

## Other roles at Quartermaster

- [Office Manager](https://feeny.ai/job/office-manager-quartermaster-arlington-xd5zf85jpj3b) — Arlington, VA
- [Associate Human Resources Generalist](https://feeny.ai/job/associate-human-resources-generalist-quartermaster-arlington-m3pqyw5c1qb2) — Arlington, VA
- [Senior Software Engineer / RF Systems](https://feeny.ai/job/senior-software-engineer-rf-systems-quartermaster-arlington-fmg80br2zt9z) — Arlington, VA
- [Technical Program Manager / RF Systems](https://feeny.ai/job/technical-program-manager-rf-systems-quartermaster-arlington-hsbht8sjs2k8) — Arlington, VA
- [VP of Supply-Fleet Recruitment](https://feeny.ai/job/vp-of-supply-fleet-recruitment-quartermaster-new-york-jx7vs2ppd95y) — New York, NY
- [Contracts Manager, Government Programs](https://feeny.ai/job/contracts-manager-government-programs-quartermaster-arlington-h3x56j223gc0) — Arlington, VA
- [Technical Program Manager](https://feeny.ai/job/technical-program-manager-quartermaster-arlington-mn55sdzt8jmb) — Arlington, VA
- [Senior Mechanical Engineer](https://feeny.ai/job/senior-mechanical-engineer-quartermaster-arlington-q6xgwr7w4v39) — Arlington, VA
- [Applied Machine Learning Engineer](https://feeny.ai/job/applied-machine-learning-engineer-quartermaster-arlington-8gxjb58ahjjf) — Arlington, VA
- [Recruiter](https://feeny.ai/job/recruiter-quartermaster-arlington-3sdcz2zcyhe3) — Arlington, VA