Cybersecurity Engineer - Application Security

Company Overview

KLA is a global leader in diversified electronics for the semiconductor manufacturing ecosystem. Virtually every electronic device in the world is produced using our technologies. No laptop, smartphone, wearable device, voice‑controlled gadget, flexible screen, VR device or smart car would have made it into your hands without us. KLA invents systems and solutions for the manufacturing of wafers and reticles, integrated circuits, packaging, printed circuit boards and flat panel displays.

The innovative ideas and devices that are advancing humanity all begin with inspiration, research and development. KLA focuses more than average on innovation and we invest 15% of sales back into R&D. Our expert teams of physicists, engineers, data scientists and problem‑solvers work together with the world’s leading technology providers to accelerate the delivery of tomorrow’s electronic devices. Life here is exciting and our teams thrive on tackling really hard problems.

There is never a dull moment with us.

We are seeking a Cybersecurity Engineer to serve as the hands‑on subject matter expert for our enterprise endpoint detection platforms. This role is responsible for the configuration, tuning, lifecycle management, and continuous improvement of our EDR and EPM tooling from a cybersecurity perspective, ensuring the platform is optimally deployed, deeply integrated with our broader security stack, and proactively evolving to address emerging threats.

You will partner closely with the SOC and IT Security teams to align detection capabilities with operational workflows, serving as the primary technical liaison.

• Support the design, configuration, and ongoing optimization of application and web security platforms, including WAF, API security, DAST/SAST tooling, RASP, and application‑layer monitoring solutions.
• Partner with application, Dev Ops, and platform teams to embed security controls into new and existing applications, ensuring security requirements are implemented pragmatically without disrupting delivery.
• Define and maintain application security baselines, configuration standards, and control requirements aligned with industry best practices and KLA security architecture.
• Ensure application and web security platforms integrate effectively with SIEM, SOAR, logging pipelines, and identity platforms to maximize security visibility and detection value.
• Support the rollout of new security capabilities through structured project implementation, including requirements gathering, testing, validation, and operational handover.
• Evaluate new tooling, features, and detection capabilities, leading proof‑of‑concept activities and supporting informed adoption decisions.
• Monitor agent health, fleet coverage, and version compliance; manage agent lifecycle including upgrades, rollouts, and rollback procedures.

• Collaborate with SOC teams to develop, tune, and maintain application‑ and web‑layer detections mapped to MITRE ATT&CK techniques and real‑world attacker behaviors.
• Improve detection fidelity by analyzing false positives, coverage gaps, and noisy signals across application logs, web telemetry, and API activity.
• Ensure critical application security events are visible, actionable, and aligned with SOC workflows and incident response playbooks.
• Assist with threat hunting activities focused on application abuse, web exploitation, authentication bypass, and API misuse using log analytics and behavioral signals.
• Support post‑incident root‑cause analysis by correlating application telemetry, security alerts, and infrastructure data to identify control gaps and improvement opportunities.

• Act as a cybersecurity engineering resource for application and platform projects, providing implementation guidance, security validation, and operational readiness support.
• Work closely with engineering and delivery teams to translate security requirements into actionable technical controls.
• Support security architecture initiatives by validating that implemented controls meet intended…