Principal Engineer - Application Security; AI security, Pen Testing, DevSecOps

Principal Application Security Engineer

Working at Target means helping all families discover the joy of everyday life. We bring that vision to life through our values and culture. Learn more about Target here.

About the Role:

We are seeking a Principal Application Security Engineer to provide technical leadership for our enterprise Application Security program. This role is responsible for advancing secure development practices, integrating security into the software development lifecycle, and partnering with engineering teams to reduce application risk through scalable security solutions. The ideal candidate combines deep technical expertise with strategic thinking, enables developers, scales security through automation, and influences engineering organizations without direct authority.

• Provide technical leadership across Secure Software Development Lifecycle (SSDLC), Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), Threat Modeling, and Penetration Testing.
• Guide engineering teams in vulnerability remediation and secure coding best practices.
• Evaluate emerging application security technologies, emerging risks, and recommend pragmatic, risk-based improvements to application security capabilities.
• Partner with Security Architecture to ensure application security practices align with enterprise security standards and design principles.

• Design and build automation that integrates security seamlessly into CI/CD pipelines.
• Develop tooling, APIs, and automation to improve developer experience and reduce manual effort.
• Partner with platform engineering teams to implement security controls within modern development workflows.
• Identify and implement opportunities to leverage AI and generative AI technologies to improve application security processes, automate repetitive tasks, enhance developer enablement, and accelerate vulnerability detection and remediation while ensuring responsible and secure use of AI.

• Help define the technical roadmap for the Application Security program.
• Develop strategies that scale security across a large engineering organization through automation, standardization, and self-service capabilities.
• Champion developer enablement by creating security guidance, reusable frameworks, documentation, and training.
• Establish and track metrics that measure program effectiveness and continuously improve security maturity.

• Influence technical decisions through collaboration and technical leadership rather than organizational authority.
• Communicate security risks and recommendations effectively to technical and non-technical audiences.
• Mentor engineers and promote security best practices across the organization.

• Solve complex application security challenges involving modern software architectures and cloud-native platforms.
• Drive continuous improvement across security tooling, developer workflows, and vulnerability management processes.
• Provide technical leadership during the investigation and remediation of significant application security issues.

This position will operate as a Hybrid/Flex for Your Day work arrangement based on Target's needs. A Hybrid/Flex for Your Day work arrangement means the team member's core role will need to be performed both onsite at the Target HQ MN location the role is assigned to and virtually, depending upon what your role, team and tasks require for that day.

Work duties cannot be performed outside of the country of the primary work location, unless otherwise prescribed by Target.  if you are curious to learn more about Minnesota.