Application Security Engineer

Job Description: - Perform penetration testing, vulnerability scanning, and manual and automated secure code reviews, including reviews of AI-generated code

• Analyze system designs to identify potential attack vectors and risks before deployment through threat modeling
• Advise engineering teams on secure coding standards, including the OWASP Top 10
• Configure and manage Web Application Firewalls, CI/CD security pipelines, and automated scanning tools
• Manage security considerations for SSO, SAML/OIDC, OAuth, MFA, service accounts, privileged access, and least-privilege principles
• Define secure design reviews, security gates, release approvals, exception-handling processes, and remediation tracking
• Oversee software composition analysis, SBOM generation and review, open-source dependency risk management, package repository security, artifact signing and verification, and third-party component security reviews
• Review application and cloud architectures, identify security risks, and define compensating controls and secure design patterns
• Promote secure use of AI coding assistants, review AI-generated code, protect sensitive information in AI workflows, and assess AI-related security risks
• Manage vulnerability triage, risk ratings, remediation deadlines, false-positive handling, retesting, and reporting
• Support secure handling of PII, encryption, retention, data minimization, privacy impact awareness, and regulatory expectations
• Secure payment integrations, assess PCI DSS scope, and review vendor AOCs and payment-provider security responsibilities
• Support application security logging, alerting, forensic readiness, incident response, and post-incident corrective actions
• Collaborate with internal and external teams to identify and remediate vulnerabilities
• Keep current with security threats, trends, and countermeasures

Requirements: - Minimum 5+ years of experience in application security, secure software development, penetration testing, or DevSecOps security

• Experience influencing engineering teams and driving remediation efforts across multiple development teams
• Deep knowledge of AWS, Azure, or GCP, including how to secure their services
• Solid understanding of DNS, HTTP, cookies, sessions, TLS, and browser security controls
• Knowledge of threat modeling, secure code reviews, and the Secure Software Development Life Cycle (SSDLC)
• Knowledge of version control (Git), containerization (Docker), and automated testing integration
• Knowledge of pipeline permissions, secrets in builds, branch protection, deployment approvals, artifact integrity, and code signing
• Experience using AI-assisted development tools such as Claude, GitHub Copilot, ChatGPT, Cursor, Amazon Q, or similar
• Ability to critically review, validate, and test AI-generated code
• Understanding of security, privacy, and intellectual property considerations associated with AI-assisted software development
• Practical understanding of container security where Docker or Kubernetes are used
• Knowledge of securing REST and GraphQL APIs against OWASP API Security Top 10 risks
• Experience implementing API gateways, OAuth 2.0, and API key rotation policies
• Experience reviewing and securing Infrastructure as Code across AWS and Azure environments, including Terraform, CloudFormation, ARM/Bicep, or similar templates
• Practical experience preventing hardcoded credentials in source code and pipelines
• Knowledge of AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, Google Secret Manager, and automated secrets scanning
• Strong ability to read, review, and write JavaScript/TypeScript, C#/.NET, Java, AJAX, Angular, React, Python, PowerShell, and SQL
• Experience with Claude Security, CoPilot Security, GitHub Dependabot, GitHub Advanced Security, SonarQube, OWASP Dependency-Check, or similar SAST, DAST, SCA, and secret-scanning tools
• Desired certifications include CISSP, CSSLP, CASE, OSCP, or OSWE
• Strong communication, teamwork, and critical-thinking skills
• Ability to maintain a safe, secure, and distraction-free remote workspace with reliable internet access
• Ability to use standard office equipment and occasionally lift up to 15 pounds

Benefits: - Competitive wages

• Healthcare (medical, dental, vision, prescription drugs, FSAs)
• 401(k) plan
• Paid time off (PTO) and holidays
• Paid parental leave
• Life and disability insurance
• Employee Assistance Program (EAP)
• Professional development and tuition assistance
• Annual discretionary bonus
• Remote work environment
• Occasional travel may be required for meetings, training, or business needs (up to 10%)