Application Security Engineer with CodeQL

Job Summary We are seeking an Application Security Engineer with mandatory hands-on experience in CodeQL to strengthen software security, improve secure development practices, and reduce vulnerabilities in production environments. The ideal candidate will have experience working within Software Security Assurance or Application Security teams, collaborating with development teams to balance security requirements with innovation. This role involves application security testing, vulnerability identification and remediation, secure coding practices, threat modeling, and the implementation and scaling of enterprise application security tools and controls. Key Responsibilities • Strengthen software security by improving development processes, enhancing security controls, and reducing software defects and vulnerabilities. • Use CodeQL to support static application security testing, identify code vulnerabilities, and facilitate remediation. • Collaborate with development teams to integrate security requirements into the software development lifecycle. • Analyze distributed data and security findings to produce clear, actionable insights. • Work with application security tools, including Software Composition Analysis (SCA), Static Application Security Testing (SAST), and secrets management solutions. • Identify common application vulnerabilities, attack vectors, and remediation strategies. • Apply secure software design principles and industry best practices throughout the development lifecycle. • Integrate application security testing tools into Agile development environments. • Support secure coding practices, code reviews, threat modeling, and security requirements analysis. • Conduct architectural risk assessments and recommend appropriate security controls. • Implement and scale enterprise application security tools, services, and controls. • Apply recognized security frameworks and standards, including OWASP, CIS, and NIST. Required Qualifications • Hands-on experience with CodeQL is mandatory. • Prior engineering experience within a Software Security Assurance or Application Security team. • Strong understanding of application security principles, common vulnerabilities, attack vectors, and remediation strategies. • Experience with application security tools, including SCA, SAST, and secrets management solutions. • Minimum 2 years of experience working with static analysis or threat modeling tools. • Experience implementing and scaling enterprise application security tools, services, and controls. • Strong understanding of secure coding practices and code review processes. • Experience with threat modeling, security requirements analysis, and architectural risk assessment. • Familiarity with OWASP, CIS, and NIST frameworks and standards. • Ability to collaborate effectively with development teams and balance security requirements with software innovation. • Strong analytical skills, including the ability to interpret security data and translate findings into actionable recommendations.