Application Security Engineer

About the job

Application Security Engineer |

Location:

Hybrid, New York, NY or Charlotte, NC | Contract

This role is a key contributor to an enterprise-wide application security program, focusing on discovering, inventorying, and securing business applications across multiple units. The position involves implementing advanced security tooling, integrating AI-assisted workflows, and collaborating closely with development teams to embed security into the SDLC.

• LEADS the discovery and inventory of applications across all business units, including ownership mapping, technology stack profiling, and risk tiering.
• STANDS UP and OPERATES the application security tooling stack, including SAST, SCA, secrets scanning, and container/IaC scanning, integrated into CI/CD pipelines.
• DESIGNS and IMPLEMENTS AI-assisted triage workflows to manage security findings, reducing developer overload and filtering false positives.
• DEFINES secure SDLC requirements, threat modeling practices, and security gates adopted by business units.
• PARTNERS with development leaders to build relationships and operationalize application security practices without impeding delivery timelines.
• CONTRIBUTES to AI security strategy by evaluating emerging tools such as AI code review assistants and automated security testing solutions, recommending operationalization strategies.
• PRODUCES executive-ready metrics and reports that demonstrate how application security activities mitigate business risks.

• 7+ years in application security, product security, or security engineering, with experience working across multiple independent business units or product lines.
• Hands-on experience deploying and managing modern application security tools such as Semgrep, Snyk, Checkmarx, Veracode, Apiiro, Ox Security, or Git Hub Advanced Security.
• Proficiency in at least three programming languages (e.g., Python, JavaScript/Type Script, Java, C#, Go) for reading, reviewing, and triaging security findings.
• Strong scripting and automation skills in Python or similar, with experience building integrations against REST APIs and working within CI/CD environments like Git Hub Actions, Git Lab CI, Jenkins, or Azure Dev Ops.
• Proven ability to influence engineering teams and drive security adoption without direct authority, including negotiating standards and building shared security playbooks.

• Experience integrating LLM-based tooling into security workflows for alert triage, finding summarization, or remediation guidance.
• Familiarity with compliance frameworks such as HITRUST, HIPAA, NIST AI RMF, or SOC 2.
• Prior experience working in regulated or healthcare-adjacent environments.
• Cloud security expertise in at least one major provider (AWS, Azure, GCP).
• Contributions to the application security community through open-source projects, conference talks, or published research.