Application Security Engineer

Vacancy Name Application Security Engineer

Vacancy No VN991

Job Title Application Security Engineer

Work Location City Minneapolis

Solifi deliver a solid financial technology foundation for equipment, working capital, wholesale, and automotive finance firms. At Solifi, we believe that commerce is only as strong as the system it runs on. Our mission is to reshape finance technology by bringing together proven solutions into a singular powerful technology platform designed to help protect and scale financial organizations. We guard our customers by being precise and reliable, we guide their success by combining powerful technology with proven expertise, and we help them grow by unleashing their potential.

The Application Security Engineer to join our ISG (Information Security Group), reporting to the Cyber Security Manager. The ISG team is responsible for protecting Solifi’s infrastructure, applications, and data assets. The Security Engineer will be working cross-functionality with IT, SaaS and Hosting, and Engineering teams.

The Application Security Engineer is responsible for contributing to the design, development, testing, and implementation of products enhancements and initiatives within the organization's IT network and SaaS Solutions. Their primary responsibility is to help safeguard the organization's development processes and product code / configurations against potential threats by supporting a comprehensive, layered secure development lifecycle and CI/CD that aligns with industry standards and best practices.

• Develops an understanding of current and emerging threats and contributes to threat research and the development of the organization's security strategy.
• Communicates and collaborates effectively with cross-functional teams to integrate security practices throughout the organization's products and software development lifecycle.
• Evaluate and recommend security technologies that strengthen the organization’s defensive posture.
• Help with Security tools migration and merging security processes and procedures.
• Lead product security reviews:
  Drive security assessments across applications and services (including web applications, APIs, and microservices) through code reviews, threat modeling, and dynamic/static analysis.
• Influence architecture and design:
  Serve as a security thought partner for product architects and engineers. Guide threat modeling efforts, assess technical risk, and champion security best practices throughout the SDLC.
• Drive strategic initiatives:
  Own high impact security projects that shape the future of our product security posture. Past initiatives have included supply chain security automation, advanced SAST/DAST integrations, and secure development training programs.
• Product / Application security Governance:
  Develop and manage security governance processes and procedures for the threat modeling program and application security design & Dev Sec Ops  programs.
• Product / Application security compliance monitoring and Reporting:
  Monitor and track compliance with application owners to ensure implementation of security controls as planned. Develops reports for management concerning residual risk and non-compliance.
• Identify and support remediation of vulnerabilities:
  Leverage available tools (e.g., static/dynamic analysis, scanning platforms, and internal reports) to investigate security issues, assess root causes, and design effective remediation strategies. Partner closely with engineering teams to provide guidance and support throughout the implementation of fixes, ensuring they align with security best practices.
• Enable engineering teams and scale application security through enablement:
  Build frameworks, guidance, and tooling that empower engineering teams to independently build secure systems. Act as a mentor and subject matter expert across teams.
• Contributes to the development and maintenance of Incident Response (IR) plans and playbooks to ensure effective handling of security incidents.
• Supports responses to security incidents, including post-event analysis to identify root causes and improve future…