Cybersecurity Engineer; Application Security

The City of New York is seeking a Cybersecurity Engineer (Application Security) to help advance the Software Security Assurance Program (SSAP). In this onsite role in Brooklyn, you will support application security testing across city systems, identify software and third‑party risks, and help teams strengthen secure development practices aligned to recognized security guidance.

You will work with security testing and application vulnerability tooling, contribute to foundational cloud vendor application security reviews, and support guidance and training grounded in secure coding standards and OWASP resources.

• Participate in the daily execution of the Software Security Assurance Program (SSAP) to help ensure applications meet security standards before deployment.
• Assist with SAST and DAST testing to identify vulnerabilities across citywide applications.
• Use Software Composition Analysis (SCA) tools to identify, track, and report vulnerabilities in open‑source and third‑party components.
• Act as a point of contact between developers and security teams to help integrate security requirements into development workflows.
• Conduct foundational security reviews of cloud vendor applications to verify compliance with city security guidelines.
• Support guidance and training materials for development teams based on secure coding standards and OWASP guidelines.
• Help update and maintain security documentation, guidelines, and compliance tracking frameworks (e.g.,
  NIST
  , CIS
  , OWASP
  ).
• Stay current on emerging cybersecurity threats and participate in team mentorship to grow application security expertise.
• Take on special projects and initiatives as assigned.

• A baccalaureate degree from an accredited college and four years of satisfactory full‑time experience related to the projects and policies required for the position; or an equivalent combination of education and/or experience.
• Hands‑on exposure to common SAST
  , DAST
  , or SCA tools (examples include Veracode
  , Checkmarx
  , Snyk
  , and Burp Suite
  ) and basic vulnerability assessment techniques.
• Familiarity with OWASP Top 10
  , fundamental secure coding concepts, and common development languages such as Python
  , Java
  , and Java Script .
• Understanding of core cloud concepts (
  AWS
  , Azure
  , or GCP
  ) and common web API security practices such as OAuth and REST
  .
• Understanding of municipal government operations, including the ability to communicate technical security risks to diverse agency stakeholders.
• Active pursuit or completion of entry‑level security certifications (examples include CompTIA Security+,
  eJPT
  , or GIAC GSEC
  ).

• SAST
  , DAST
  , SCA
• Veracode
  , Checkmarx
  , Snyk
  , Burp Suite
• OWASP Top 10
  , NIST
  , CIS
  , OWASP
• Python
  , Java
  , Java Script
• AWS
  , Azure
  , GCP
• OAuth
  , REST
• CompTIA Security+,
  eJPT
  , GIAC GSEC

• Day shift; due to technical duties in a 24/7 operation, you may be required to work various shifts, including weekends and/or nights/evenings.

• Location: Brooklyn, NY (onsite)
• Salary: USD 75,000 - 95,000 per year

• Public Service Loan Forgiveness: As a prospective City of New York employee, you may be eligible for federal loan forgiveness programs and state repayment assistance programs.
• Residency requirement: New York City residency is not required for this position.