Application Security Engineer Job New York New York USA,IT/Tech

Location: New York

Hybrid: 3 days onsite per week

No C2C or Third-Party Candidates

Position Overview

We are seeking an experienced Application Security Engineer to help drive and operationalize enterprise application security initiatives across multiple business units. This role will focus on application discovery, App Sec tooling implementation, Dev Sec Ops integration, AI-assisted security workflows, and secure SDLC enablement.

This is both a technical and relationship-driven role, requiring close collaboration with development leaders and engineering teams to embed scalable security practices without disrupting delivery velocity.

Key Responsibilities

Lead application discovery and inventory efforts across multiple business units
Perform ownership mapping, technology stack profiling, and risk tiering for enterprise applications
Deploy, configure, and manage App Sec tooling including:
SAST
SCA
Secrets scanning
Container/IaC scanning
Integrate security tooling into CI/CD pipelines and Dev Ops workflows
Design and implement AI-assisted triage workflows to reduce false positives and improve remediation prioritization
Define and operationalize secure SDLC requirements and security gates
Conduct and support threat modeling exercises using frameworks such as STRIDE or PASTA
Collaborate with development leaders to build scalable App Sec processes and adoption strategies
Evaluate emerging AI security tools and recommend operational use cases
Develop executive-level reporting and metrics aligned to business risk reduction
Build automation and integrations using scripting and REST APIs

Required Qualifications

7+ years of experience in:
Application Security
Product Security
Security Engineering
Experience working in environments supporting multiple business units or product lines
Hands-on experience with modern App Sec tools such as:
Semgrep
Checkmarx
Veracode
Ox Security
Git Hub Advanced Security
Working proficiency in at least three programming languages such as:
Python
Java
C#
Go
Strong scripting and automation skills in Python or similar languages
Experience integrating security tooling into CI/CD platforms including:
Git Hub Actions
Jenkins
Strong understanding of:
OWASP Top 10
Threat modeling methodologies
Modern application attack patterns and supply chain risks
Ability to influence engineering teams and drive security adoption without direct authority

Preferred Qualifications

Experience integrating LLM or AI tooling into security workflows
Familiarity with compliance frameworks such as:
HITRUST
HIPAA
SOC 2
NIST AI RMF
Experience in regulated or healthcare-related environments
Cloud security experience with AWS, Azure, or GCP
Contributions to the App Sec community (OSS, research, speaking engagements, etc.)

#J-18808-Ljbffr