Application Security Engineer

Nintendo of America

About Nintendo of America: From the launch of the Nintendo Entertainment System™ more than 30 years ago, Nintendo’s mission has been to create smiles through unique entertainment experiences. Here at Nintendo of America Inc., we deliver on this mission by partnering closely with Nintendo Co., Ltd., to bring Nintendo’s iconic and cherished franchises including Mario™, Donkey Kong™, The Legend of Zelda™, Metroid™, Animal Crossing™, Pikmin™ and Splatoon™ across the Americas through our video games, hardware systems, and collaborations with partners on a range of other entertainment initiatives like feature films and theme parks.

We are an equal opportunity employer offering a welcoming and inclusive environment in service to one another, our products, and the diverse consumers and communities we call home. For more information about Nintendo, please visit the company’s website at https://www.nintendo.com/.

SUMMARY:
This role is part of the IT: Information Security department at Nintendo of America (NOA) and provides hands-on application and AI security engineering for enterprise applications, APIs, cloud services, and AI-enabled solutions. Partners with developers to assess risks, improve secure designs, and build automated security capabilities across the software development lifecycle.

DESCRIPTION OF DUTIES

• Application Security
  • Performs security assessments, threat modeling, architecture reviews, and secure code reviews for enterprise applications, APIs, and cloud services.
  • Evaluates authentication, authorization, data protection, secrets management, and other application controls; partners with developers to prioritize and validate remediation.
  • Develops reusable secure design patterns and provides practical secure coding guidance throughout the software development lifecycle.
  • Supports investigation and remediation of application and API security incidents.
• AI Security
  • Assesses AI-enabled applications, including large language models (LLMs), retrieval-augmented generation (RAG), agents, and connected tools or Model Context Protocol (MCP) integrations.
  • Identifies and helps mitigate prompt injection, sensitive information disclosure, insecure output handling, excessive permissions, and unsafe tool use.
  • Partners with application, cloud, and AI teams to implement least privilege, data protection, security testing, and technical guardrails; translates emerging threats into practical recommendations.
  • Establishes security review criteria for new AI use cases, including data classification, data handling, model and vendor risk, and approval conditions aligned with AI governance processes and frameworks such as NIST AI RMF and OWASP guidance for LLM applications.
  • Reviews identity, access, and logging for AI agents, service accounts, and connected tools, ensuring agent actions are authorized, observable, and auditable.
  • Partners with peer security engineers to define detection and response for AI-related threats.
• Security Engineering & Automation
  • Builds and integrates security testing into CI/CD pipelines and developer workflows, including static and dynamic testing, dependency analysis, secrets detection, and API testing.
  • Develops scripts, tools, and integrations to streamline vulnerability analysis, remediation tracking, and repeatable security processes; evaluates responsible uses of AI to improve these capabilities.
  • Maintains and troubleshoots security solutions, evaluates new technologies, and ensures work aligns with established compliance requirements and internal controls.

SUMMARY OF REQUIREMENTS

• Minimum of five (5) years of related experience in application security, security engineering, software engineering, or a related technical security discipline.
• Experience with application assessments, threat modeling, architecture reviews, secure code reviews, and common application vulnerabilities and defenses.
• Understanding of web applications, APIs, cloud services, authentication, authorization, secrets management, and data protection. Ability to read application code; experience with security testing tools, CI/CD pipelines, and automated security checks.
• Strong communication skills, including translating technical risks into clear recommendations for technical and non-technical audiences.
• Foundational understanding of generative AI (ex. CoPilot, Claude), LLM-enabled applications, and related security risks, or demonstrated ability to develop that knowledge quickly.
• Experience with cloud platforms (AWS), API penetration testing, microservices, containers (Kubernetes), in multi-team enterprise environments.
• Familiarity with AI risk and governance frameworks and common AI threats (ex. OWASP), such as prompt injection, data leakage, model or supply chain compromise, and misuse of autonomous agents preferred. Practical AI security experience preferred.
• Experience with Python or another scripting language preferred.
• Undergraduate degree in Computer Science, Cybersecurity, Software Engineering, a related field, or equivalent combination of education and experience.

Applicants must be legally eligible to work in the United States to be considered. Visa sponsorship is not available for this role.

This position is hybrid in Redmond, WA. Hybrid positions require regular onsite work following the schedule and guidelines for their division. This position is not open to fully remote status at this time.

This position includes the base pay range listed below, potential for a semi-annual discretionary performance bonus, and a comprehensive benefits package that includes medical, dental, vision, 401(k), and paid time off.

Pay Range:

$108,450—$173,550 USD

Minimum five years experience in application security or related technical security discipline. Experience with application assessments, threat modeling, architecture reviews, secure code reviews, common application vulnerabilities, web applications, APIs, cloud services, authentication, authorization, secrets management, and data protection. Ability to read application code; experience with security testing tools, CI/CD pipelines, and automated security checks. Foundational understanding of generative AI/LLM applications and related security risks. Experience with cloud platforms (AWS), API penetration testing, microservices, containers (Kubernetes). Familiarity with AI risk/governance frameworks (NIST AI RMF, OWASP) and AI threats (prompt injection, data leakage). Undergraduate degree in Computer Science, Cybersecurity, Software Engineering, or equivalent. Applicants must be legally eligible to work in the United States.