This is a fully remote position, open to applicants in Alabama, +2 more states.

📋 Description

• Incorporate security requirements and threat modeling throughout the architecture, design, development, testing, release, and exception processes.

• Execute and validate SAST, DAST, SCA, API, mobile, and manual security assessments.

• Differentiate between exploitable vulnerabilities and tool-generated noise.

• Perform security design and architecture evaluations for web, API, cloud-native, containerized, and distributed applications.

• Collaborate with developers to offer code-level or design-level remediation advice and confirm closure.

• Develop or enhance CI/CD security controls, scanning integrations, secure coding standards, and developer support.

• Assess application vulnerabilities and security debt based on risk, exploitability, asset criticality, and business context.

• Examine recurring defect trends and promote preventive control enhancements across engineering teams.

⛳️ Requirements

• Practical experience in application security testing, secure code review, and vulnerability validation.

• In-depth understanding of OWASP Top 10/API risks, authentication/authorization frameworks, session management, cryptography principles, input validation, and common web/application attack strategies.

• Familiarity with SAST, DAST, SCA, API testing, secrets scanning, and CI/CD security tools.

• Comprehension of modern software architectures, REST/GraphQL APIs, containers, cloud services, and software supply-chain dependencies.

• Capability to engage developers on a technical level and provide actionable remediation recommendations.

• Experience in applying secure SDLC, threat modeling, architecture review, risk-based exceptions, and application-risk prioritization.

• Ability to translate exploitability into business impact and risk management decisions.

• Knowledge of security-control objectives for application development and deployment.

• Bachelor's degree in Computer Science, Software Engineering, Cybersecurity, Information Technology, or a related field, or equivalent relevant professional experience.