Security Engineer; Application Security

Blue Cross Blue Shield Association is seeking a Security Engineer focused on application security to strengthen secure engineering practices across a broad set of cloud-native and software delivery environments. In this hybrid role based in Chicago, you will apply security engineering and assessment approaches spanning web, API, containerized, and microservices-based applications, while partnering with architects and stakeholders to support roadmaps, risk management, and incident response readiness within the application security domain.

The Security Engineer (Application Security) will apply application security engineering, assessment, and secure software development practices across cloud-native applications and Dev Sec Ops  pipelines. You will help integrate security controls and testing throughout the software development lifecycle, support the application vulnerability assessment lifecycle, and contribute to operational excellence, risk visibility, and remediation outcomes.

• Partner with architects and key stakeholders to interpret engineering and operational guidance within a security domain or program and contribute across multiple related projects.
• Lead development of comprehensive roadmaps for multiple projects or departments.
• Drive operational excellence through process improvement initiatives, including designing and executing improvements.
• Identify and implement strategic savings opportunities to support significant cost optimization efforts.
• Improve security risk visibility by developing and overseeing robust risk management frameworks.
• Support domain incident response efforts as needed, maintain the defined security architecture, and manage domain-specific security tools.
• Apply application security engineering, assessment, and secure software development practices across cloud-native, web, API, containerized, and microservices-based applications.
• Support the application vulnerability assessment lifecycle and integrate security controls and testing throughout the software development lifecycle and Dev Sec Ops  pipelines.

• Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent work experience.
• 5+ years of cybersecurity experience with a preferred focus on application security, vulnerability assessments, and secure software development practices.
• Experience implementing risk remediation prioritization, including collaboration with stakeholders to understand risk drivers and remediation blockers.
• Experience monitoring and tracking remediation efforts, staying current on emerging threats, and leading the design, implementation, and maintenance of domain-specific toolsets.
• Experience conducting SAST, DAST, SCA, SBOM analysis, API security assessments, secure code reviews, threat modeling, and risk assessments.
• Experience managing the Application Vulnerability Assessment (AVA) cycle, including planning, validation and rating, reporting, remediation guidance and tracking, and validation of fixes.
• Experience assessing cloud-native, web, API, containerized, and microservices-based applications across Azure, AWS, Kubernetes, and Open Shift.
• Experience working with internal and external auditors and Governance, Risk, and Compliance (GRC) teams to provide assessment evidence, address findings, and support compliance activities.
• Experience with Infrastructure as Code technologies, including Terraform, Bicep, ARM Templates, YAML, Docker, Kubernetes manifests, and Helm, plus the ability to develop automation and security testing scripts.
• Ability to plan, develop, implement, and update the company’s information security strategy.
• Excellent communication and presentation skills for both technical and non-technical…