The Senior Application Security Engineer works closely with development teams to embed security practices across the SDLC. This role leads secure design reviews, conducts code-level assessments, integrates security automation into pipelines, and coaches developers on secure coding standards. The Senior AppSec Engineer partners cross-functionally to proactively manage software security risks.
Job Duties and Responsibilities:Technical Assessment and Security Review – 35%
- Facilitate threat modeling workshops during application design phases.
- Conduct secure code reviews and static analysis of internally developed codebases.
- Guide vulnerability remediation planning for application security findings.
Secure Development and CI/CD Integration – 30%
- Integrate AppSec tooling (SAST, SCA, DAST, secrets scanning, IaC scanning) into CI/CD pipelines.
- Collaborate with DevOps teams to embed security testing within deployment pipelines.
- Develop proof-of-concept secure coding examples and remediation guidance for developers.
Security Standards, Threat Intelligence, and Documentation – 20%
- Monitor emerging application threats and recommend control adjustments.
- Maintain security standards documentation and coding guidelines.
Mentorship and Compliance – 15%
- Provide mentorship to junior AppSec team members.
- Support regulatory compliance reviews related to application development.
Qualifications (Education, Experience, Certifications & KSA):- Bachelor’s degree or equivalent combination of education and experience required.
- Master’s degree preferred.
- 8-10 years of work-related experience required.
Required Certification:
- ISC² CCSLP (Certified Secure Software Lifecycle Professional)
Optional / Recommended Certifications:
- GIAC GWAPT (GIAC Web Application Penetration Tester) – if not already obtained
- Offensive Security OSWE (Offensive Security Web Expert)
- GIAC GCSA (GIAC Cloud Security Automation)
- ISC² CCSP (Certified Cloud Security Professional)
- ISC² CGRC (Certified in Governance, Risk and Compliance)
The above statements are intended to describe the general nature and level of work being performed by people assigned to this job. They are not intended to be an exhaustive list of all responsibilities, skills, efforts or working conditions associated with a job.
