Lead Application Security Engineer in Scottsdale

Job Description Job Description

Build it. Break it. Secure it. Lead it.

CNA is hiring a Lead Java Application Security Engineer who can write production code and eliminate real-world vulnerabilities
—not just talk about them.

This is a hands‑on leadership role where you’ll split your time between:

• Securing applications (SAST/DAST, OWASP, API security)
• Building modern apps (Java, Spring Boot, Angular)

• You won’t be siloed—you’ll own both security and engineering outcomes
• You’ll fix vulnerabilities in code
  , not just report them
• You’ll influence architecture, standards, and engineering culture
• You’ll work on modern stacks with real business impact

• Run and act on Veracode (or similar) SAST/DAST/SCA scans
• Remediate vulnerabilities directly in Java + Angular codebases
• Secure APIs using OAuth2, JWT, authn/authz best practices
• Lead design and delivery of scalable applications
• Mentor engineers and raise the bar on secure coding
• Evaluate AI‑generated code (Copilot) for security risks

• 5+ years in Application Security (hands‑on)
• 7+ years in Java + Angular development
• Proven technical leadership experience
• Strong knowledge of OWASP Top 10 & API security
• Experience with tools like Veracode, Checkmarx, or Fortify

• AI‑assisted dev/security tools
• AWS or GCPSecurity certifications