Responsibilities
The Application Security Engineer plays a crucial role in securing our growing portfolio of applications. This role will focus on integrating security best practices into the Software Development Lifecycle (SDLC), ensuring compliance with regulatory requirements, proactively mitigating threats, and collaborating closely with developers to enhance the overall security posture of our applications.
As a subject matter expert in application security, the Application Security Engineer will lead the charge in finding and implementing innovative security solutions while ensuring the organizationremainsresilient against evolving threats. This individual will work closely with development and IT teams to embed security into application architecture, offer technical guidance to junior team members, and drive the implementation of security initiatives essential for meeting business and compliance needs.
Responsibilities
- Partner with development teams to embed security best practices across the SDLC, including design, development, and deployment, andprovidesecure coding guidance
- Conduct threat modeling and security architecture reviews toidentifydesign-level risks and implementappropriate securitycontrols
- Identify, assess, and mitigate application vulnerabilities through a combination of automated (SAST/DAST) and manual code reviews, as well as penetration testing, and drive risk-based remediation
- Implement and manage application security tools, including SAST, DAST, Software Composition Analysis (SCA), and other security scanning solutions
- Ensure application security practices align with regulatory standards such as NYDFS, NIST, and OWASP guidelines
- Partner with DevOps, IT, and security teams to integrate security into CI/CD pipelines and engineering workflows
- Design and oversee the implementation of authentication, authorization, and access control mechanisms for APIs and platforms
- Develop and enforce secure usage standards and governance for AI tools and AI-generated code, addressing risks such as prompt injection, data leakage, insecure code generation, and model misuse, while aligning with regulatory and industry standards
Qualifications
- 5+ years of experience in application security, secure software development, and vulnerability management
- Strong knowledge of secure coding practices, OWASP Top 10,OWASP Top 10 for LLMs, MITRE ATLAS,and common security vulnerabilities
- Experience with containerization technologies such as Docker and Kubernetes, the principles of container operation, and their secure interaction
- Experience with security testing tools (e.g., Burp Suite, Fortify, Veracode, or similar)
- Experience with Black Duck/Polaris with Apex code (Salesforce) is a plus
- Familiarity withDevSecOpsprinciples and integrating security into CI/CD pipelines
- Direct experience with security tools such as vulnerability scanners, intrusion detection systems, and log analysis tools
- Understanding of regulatory frameworks and compliance requirements (e.g., NYDFS, GDPR, SOC 2)
- Ability in scripting and automation using languages such as Python, PowerShell, or Bashand leverage AI driven tools to streamline and enhance security process and workflows
- Experience withBlackDuck/PolarisandApex code (Salesforce) is a plus
- Relevant certifications such as CertifiedDevSecOpsEngineer, CISSP, OWASP certifications, GIAC GWAPT
#LI-CC1
