Application Security Engineer

Job Summary

We seek a highly motivated and experienced Application Security Engineer to join our growing security team. This role is highly technical and candidates must possess a solid understanding of the security and privacy of our company's applications and data.

The Application Security Engineer must understand development, coding, security engineering, and secure systems configurations. This position ensures that every step of the software development lifecycle (SDLC) follows security best practices. This involves conducting security assessments with SAST and DAST tools, reading source code, threat modeling, and designing and implementing secure software development practices. They will determine where security vulnerabilities exist and implement fixes.

They must understand how an application may be misused and exploited. The Application Security Engineer will collaborate with software development teams and provide guidance on best practices for secure coding. They will also stay up to date on the latest security trends and technologies and integrate them into the organization's security strategy.

• Conduct security assessments that require expertise of our organization's applications using both Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) methodologies.
• Collaborate with software development teams to integrate security into the development life cycle.
• Conduct security assessments of web, mobile, and other applications; analyze assessment results to identify vulnerabilities and provide guidance on remediation.
• Design and implement secure software development practices, including threat modeling, secure coding standards, and code review.
• Stay current with security threats, trends, and technologies, and recommend new security controls as needed.
• Conduct application security investigations and provide recommendations to mitigate risk.
• Maintain security documentation, provide subject‑matter expertise, and collaborate on security policies, procedures, and standards.

• Perform other duties as assigned.

• Bachelor's degree in computer science, information security, or a related field.

• Five (5) or more years with OWASP, SAST, DAST, SCA, RASP, and common security tools.
• Seven (7) or more years in application security, security engineering, software development, or a related field.
• Five (5) or more years of strong understanding of web application security and common attack vectors (e.g., SQL injection, XSS, CSRF).
• Five (5) or more years of experience with secure coding practices, threat modeling, and secure SDLC methodologies.
• Five (5) or more years of proven experience diagnosing, isolating, and resolving complex issues and recommending/implementing solutions.
• Five (5) or more years of demonstrated experience with systems integration processes, methodology, and tools.
• Seven (7) or more years of development and scripting experience.
• Five (5) or more years in a professional application security role.
• Five (5) or more years of experience with API and Web Security.
• Three (3) or more years of experience with WAF or similar application security infrastructure (optional).
• Seven (7) or more years of experience integrating security in CI/CD and Dev Ops.
• Six (6) or more years of process or operation management experience.
• Six (6) or more years of experience in value‑stream mapping, continuous flow, pull replenishment, and other process improvement.

• Excellent communication skills, both verbal and written, and ability to work effectively with cross‑functional teams.
• Ability to create and maintain professional relationships at all levels of the organization.
• Ability to work independently and as part of a team.
• Flexibility to operate and self‑driven to excel in a fast‑paced environment.
• Capable of multi‑tasking, highly organized, with excellent time‑management skills.
• Proficiency in at least one programming language (e.g., Python, .NET, JavaScript) with .NET preferred.
• Proficiency in at least one common scripting language (e.g., Power Shell, Bash) required.
• Familiarity with NIST framework, PCI, ISO 27001, SOC, SOX, CCPA, GDPR,…