Application Security Engineer

• Select, deploy, and tune SAST tooling across our repositories, integrating scans into pull requests and CI/CD pipelines with practical quality gates.
• Implement and operate DAST scanning against our web applications and APIs in staging and production-like environments.
• Add software composition analysis and dependency scanning to track vulnerable open-source components.
• Reduce false positives and alert fatigue through rule tuning, baselining, and severity thresholds so developers trust the results and act on them.
• Recommend and implement secrets management solutions and practices that align with our existing policies and standards for storing, distributing, rotating, and auditing secrets.
• Deploy secret scanning in repositories, commit hooks, and pipelines to catch hardcoded credentials before they ship, and partner with DevOps to remove long-lived credentials from pipelines, configurations, and infrastructure-as-code.
• Lead the response when secrets are exposed: revoke, rotate, assess impact, and fix the root cause.
• Triage findings from scanners, penetration tests, external reports, and internal reviews, prioritizing by exploitability, exposure, and business impact rather than raw severity scores.
• Work directly with developers and DevOps engineers to understand root causes, propose practical fixes, and agree on realistic remediation timelines.
• Track findings to closure in the teams’ existing workflow tools, and define and enforce remediation SLAs by severity.
• Identify recurring vulnerability patterns and address them at the source through shared libraries, secure defaults, and pipeline guardrails.
• Perform manual code reviews and targeted security testing on high-risk features such as authentication, file uploads, and APIs.
• Provide clear, actionable remediation guidance with code-level examples, and contribute to secure coding standards aligned to OWASP Top 10 and ASVS.
• Participate in design and architecture discussions to provide security input and threat modeling for new features and services.
• Build the roadmap, processes, and tooling strategy for a new application security function, including build-versus-buy recommendations and vendor evaluations.
• Define and report application security metrics to security leadership, such as scan coverage, mean time to remediate, and open critical and high findings.
• Support audit and compliance requirements related to secure development, and contribute to incident response for application-layer security events.

Required Qualifications:

• BA/BS in Computer Science, Information Technology, Cybersecurity, or a related field, with 5+ years of experience in application security, product security, or a security-focused engineering role, or equivalent practical experience.
• Hands-on experience deploying and operating SAST and DAST tools in CI/CD pipelines, including tuning them for accuracy.
• Experience implementing secrets management and secret scanning in a production environment.
• Strong knowledge of web application vulnerabilities (OWASP Top 10, CWE Top 25) and how to remediate them in code.
• Working knowledge of authentication and identity management workflows and protocols (e.g., SAML, OAuth 2.0, OpenID Connect, SSO, session management) and the common security flaws in how they are implemented.
• Ability to read and review code in at least one modern language (e.g., Python, JavaScript/TypeScript, Java, C#, Go).
• Working knowledge of CI/CD platforms (e.g., GitHub Actions, GitLab CI, Jenkins) and DevOps practices.
• Demonstrated experience working with developers to fix security issues, not just report them.

Preferred Qualifications:

• Experience building or significantly maturing an application security program from scratch.
• Experience with threat modeling methodologies such as STRIDE or PASTA.
• Experience with cloud and container security (e.g., Microsoft Azure, AWS, or GCP; Docker and Kubernetes).
• Experience with infrastructure-as-code security scanning and API security testing.
• Experience evaluating security tooling, including build-versus-buy decisions.
• Familiarity with security compliance frameworks such as SOC 2, and with supply chain security concepts such as SBOMs and SLSA.
• Relevant certifications such as GWAPT, OSWE, CSSLP, or equivalent.

Skills & Competencies:

• Strong systems thinking, with the ability to embed security controls into engineering workflows without slowing teams down.
• Sound judgment to prioritize findings based on real risk and to explain trade-offs to both engineers and leadership.
• Excellent written and verbal communication, with the ability to produce clear, actionable remediation guidance and documentation.
• Collaborative, pragmatic approach to influencing teams without direct authority.
• Ability to move effectively between hands-on technical work and program-level planning.
• Ability to work independently and drive initiatives through ambiguity in a function that is new to the organization.