Application Security & Vulnerability Engineer

Performance Food Group is a customer-centric food service distribution leader headquartered in Richmond, Va. Grounded by roots that date back to a grocery peddler in 1885, PFG has a nationwide network of approximately 150 distribution centers, 35,000-plus talented associates, and thousands of valued suppliers across the country. With the goal of helping customers thrive, PFG markets and delivers quality food and related products to independent and chain restaurants, schools, business and industry locations, convenience operations, healthcare facilities, vending distributors, office coffee service distributors, big box retailers, and theaters across the U.S.

• Competitive pay and benefits, including Day 1 Health & Wellness Benefits, Employee Stock Purchase Plan, 401K Employer Matching, Education Assistance, Paid Time Off, and much more
• Growth opportunities performing essential work to support America's food distribution system
• Safe and inclusive working environment, including culture of rewards, recognition, and respect

Performance Food Group is looking for a talented Application Security & Vulnerability Engineer to lead efforts in securing PFG's application landscape and enterprise vulnerability management program. This role partners closely with Infrastructure and Application Development teams to establish the foundational application security program by implementing scanning processes, coordinating remediation with application teams, building reporting and metrics, and supporting secure development practices across the software development lifecycle throughout the CI/CD pipeline.

The candidate will also support the broader Information Security Program, including incident response, threat intelligence, and compliance initiatives.

• Partner with application development and business teams to build and mature PFG's Application Security program and secure coding practices
• Conduct application security assessments using code scanning (SAST/DAST), dependency/composition analysis (SCA), and security testing tools; coordinate remediation through closure with application owners
• Evaluate applications and CI/CD pipelines to integrate security controls, automate vulnerability detection, and improve remediation processes and timelines
• Advise development teams on secure coding practices and help embed security requirements earlier in the development lifecycle
• Develop developer security training content and drive adoption of secure development practices across applicable functional areas.
• Track and report on application vulnerability trends, remediation SLAs, and program maturity to IT leadership and application owners
• Identify and evaluate security risks within application development and deployment processes, helping promote secure access controls and governance practices.

• Support enterprise Vulnerability Management program, including scanning, prioritization, remediation tracking, and reporting
• Monitor threat intelligence feeds (SANS, software manufacturer alerts, industry news) for relevant threats and vulnerabilities; work with delivery teams to track, prioritize, and remediate identified gaps
• Support activities within the Security Incident Response program, Security Education Awareness Program, and other compliance activities as needed
• Perform other cybersecurity related duties as assigned

• Associate's degree in Information Technology, Computer Science, Cybersecurity or related field or equivalent 3-5 years direct application security experience
• 3-5 years of related work experience in information security or application security
• Demonstrate working knowledge of programming and scripting languages (e.g., RPG, C#, Lansa, and React) and Infrastructure as Code (IaC) concepts to identify, assess, and help remediate application and code-based security vulnerabilities.
• Hands-on or conceptual experience with application development and/or security tools: static/dynamic code scanning (SAST/DAST), software composition analysis (SCA), and dependency scanning
• Understanding of secure SDLC practices and how to integrate security into CI/CD pipelines
• Conceptual understanding of vulnerability scanning solutions, such Tenable/Nessus and code scanning applications
• Familiarity with web application security fundamentals, including common application vulnerabilities, authentication and…