Sr. Engineer, Application Security

The Sr. Application Security Engineer will help implement, operate, and maintain software security capabilities supporting Carnival’s global brands in a digital, cloud-based environment. This role focuses on security control implementation, automation through scripts and APIs, and building cloud and Kubernetes infrastructure to enable application security services.

• Program, engineer, implement, and administer IT Security technical controls and tools used to assess vulnerabilities, misconfigurations, and incidents.
• Partner with development teams to test and evaluate software vulnerabilities using inputs such as security scanners and bug bounty programs.
• Design and automate governance processes and controls that ensure application security activities are consistently performed and made easier for software development teams.
• Develop and maintain cloud infrastructure and Kubernetes clusters, using modern infrastructure as code (IaC) practices to host Application Security capabilities for brand teams.
• Conduct security reviews of applications and releases to confirm alignment with relevant policies, standards, and guidelines.

• Bachelor’s Degree in Computer Science, Software Engineering, Mathematics, or a similar field, plus 5+ years of professional experience.
• Hands‑on experience writing software applications, including APIs
  , web applications
  , and scripts
  .
• Strong experience operating and administrating common security tools, including SAST and DAST scanners.
• Proven ability to communicate security findings to teams and drive remediation follow-through.
• Hands‑on experience performing threat modeling and adversarial testing of software applications.
• Hands‑on experience with cloud‑native development and operations, including CI/CD pipelines
  , cloud compute resources, and containerization (for example,
  Docker and Kubernetes
  ).
• Work primarily in a climate‑controlled environment with minimal safety or health hazard potential.
• Ability to remain in a stationary position at a desk and/or computer for extended periods.

• SAST, DAST
• APIs, web applications, scripts
• Threat modeling, adversarial testing
• Kubernetes, Infrastructure as Code (IaC)
• CI/CD pipelines, cloud compute resources
• Containerization, Docker

• All non‑sales roles participate in an annual cash bonus program.
• Director and above roles may also be eligible for Carnival’s discretionary equity incentive plan.
• Cost‑effective medical, dental, and vision plans.
• Employee Assistance Program and other mental health resources.
• Company‑paid term life insurance and disability coverage.
• 401(k) plan with company match.
• Employee Stock Purchase plan.
• Paid Time Off: 8 company‑wide holidays plus 2 additional floating holidays.
• Vacation Time: 14 days/year for manager and below; 19 days/year for director and above.
• Sick Time: 80 hours per year for full‑time employees.
• Complementary stand‑by cruises, employee discounts on confirmed cruises, and special rates for family and friends.
• Personal and professional learning and development resources, including tuition reimbursement.
• On‑site Fitness center at the Miami campus.

No or very little travel is likely.

This position is classified as remote
, allowing full‑time work from the employee’s home. It may also require regular travel to Carnival headquarters in Miami, FL for in‑office collaboration. Candidate sourcing is primarily conducted in Carnival’s remote hubs of Orlando, Tampa, Atlanta, Houston, and Dallas. If the search extends beyond those areas, candidates must be located in one of the following U.S. states:
FL, GA, TX, and NC
.