Application Security Engineer, Information Security

Ascensus is the leading independent technology and service platform powering savings plans across America, providing products and expertise that help nearly 16 million people save for a better today and tomorrow.

Reporting to the BISO, the Application Security Engineer is responsible for the application security program. This position requires a passion for data protection, possesses a combination of either application development and/or security experience, strong communication and organizational skills, collaborative abilities, self-motivation, innovation, efficiency and attention to detail. This position willperforma variety of application security responsibilities across Ascensus and be the primary resource forour application security program.

This role serves as a trusted application security advisor to Ascensus scrum teams to drive best practices for application security, to help ensure the confidentiality, integrity and availability of our web and application program interfaces (API). The Application Security Engineer is deeply involved with our application scrum teams and is instrumental in helping define the strategy to meet the information security organizations high level goals, while still being embedded within the scrum team processes and serve as a subject matter expert in secure development practices.

This is a critical role at Ascensus requiring strategic thinking, taking initiative, and proactive interaction at many levels. This role will receive strong support of the Head of Technology and the Information Security Leadership, to effectively execute on defined organizational goals and strategic plans.

• Responsible for protecting, securing, and proper handling of all confidential data held by Ascensus to ensure against unauthorized access, improper transmission, and/or unapproved disclosure of information that could result in harm to Ascensus or our clients.
• Our I-Client service philosophy and our Core Values of People Matter, Quality First and Integrity Always® should be visible in your actions on a day to day basis showing your support of our organization
• In conjunction with security and development leadership develops a comprehensive, agile, and innovative Dev Sec Ops  approach that supports all phases of the software development lifecycle (SDLC), identifies and effectively manage risk.
• Provide security consultation to scrum teams, application owners, and technology teams on relevant security controls and secure SDLC process
• Participate in sprint planning meetings and various decision-making sessions to ensure that security requirements and considerations are built into the development practices
• Conduct application security analysis, including architecture review, analysis of data flows, penetration testing support, and threat modeling
• Build and monitor compliance with application security policies, coding standards, and security controls in support of mitigating threats
• Responsible for the deployment and integration of services to support SAST, DAST and SCA functions. Assist development teams in performance of static and dynamic testing, triage findings and provide remediation guidance where necessary
• Assist with other tasks and projects as assigned

• N/A

• A minimum of 4 years’ experience in Secure Software Development and/or Dev Sec Ops  (preferred)
• Ability to define software security and privacy requirements
• Solid understanding of threat modeling, risk, and mitigation from internal and external threats
• Experience with development of system security architecture diagrams and security architecture…