Application Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Conduct penetration testing, vulnerability assessments, and both manual and automated secure code evaluations, including reviews of AI-generated code.

• Examine system designs to pinpoint possible attack vectors and risks prior to deployment through threat modeling.

• Provide guidance to engineering teams on secure coding practices, including adherence to the OWASP Top 10.

• Configure and oversee Web Application Firewalls, CI/CD security pipelines, and tools for automated scanning.

• Address security considerations for SSO, SAML/OIDC, OAuth, MFA, service accounts, privileged access, and adherence to least-privilege principles.

• Establish secure design reviews, security checkpoints, release approvals, exception-handling procedures, and remediation tracking.

• Manage software composition analysis, generation and review of SBOMs, open-source dependency risk management, package repository security, artifact signing and verification, and third-party component security assessments.

• Assess application and cloud architectures, identify security vulnerabilities, and define compensating controls and secure design patterns.

• Advocate for the secure use of AI coding assistants, review AI-generated code, safeguard sensitive information within AI workflows, and evaluate AI-related security risks.

• Oversee vulnerability triage, risk ratings, remediation timelines, handling of false positives, retesting, and reporting.

• Facilitate secure management of PII, including encryption, retention, data minimization, privacy impact awareness, and regulatory compliance.

• Ensure security in payment integrations, evaluate PCI DSS scope, and review vendor AOCs along with payment-provider security responsibilities.

• Assist in application security logging, alerting, forensic readiness, incident response, and post-incident corrective measures.

• Collaborate with both internal and external teams to identify and remediate vulnerabilities.

• Stay updated on security threats, trends, and countermeasures.

⛳️ Requirements

• At least 5+ years of experience in application security, secure software development, penetration testing, or DevSecOps security.

• Proven ability to influence engineering teams and drive remediation initiatives across various development teams.

• Extensive knowledge of AWS, Azure, or GCP, particularly in securing their services.

• Strong understanding of DNS, HTTP, cookies, sessions, TLS, and browser security measures.

• Familiarity with threat modeling, secure code evaluations, and the Secure Software Development Life Cycle (SSDLC).

• Knowledge of version control (Git), containerization (Docker), and integration of automated testing.

• Understanding of pipeline permissions, secrets management in builds, branch protection, deployment approvals, artifact integrity, and code signing.

• Experience with AI-assisted development tools such as Claude, GitHub Copilot, ChatGPT, Cursor, Amazon Q, or similar technologies.

• Capability to critically assess, validate, and test AI-generated code.

• Awareness of security, privacy, and intellectual property concerns related to AI-assisted software development.

• Practical knowledge of container security, specifically in environments using Docker or Kubernetes.

• Understanding of securing REST and GraphQL APIs against the OWASP API Security Top 10 risks.

• Experience implementing API gateways, OAuth 2.0, and policies for API key rotation.

• Proven experience reviewing and securing Infrastructure as Code within AWS and Azure environments, including Terraform, CloudFormation, ARM/Bicep, or similar templates.

• Practical experience in preventing hardcoded credentials within source code and pipelines.

• Familiarity with AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, Google Secret Manager, and automated secrets scanning.

• Strong proficiency in reading, reviewing, and writing JavaScript/TypeScript, C#/.NET, Java, AJAX, Angular, React, Python, PowerShell, and SQL.

• Experience with tools such as Claude Security, CoPilot Security, GitHub Dependabot, GitHub Advanced Security, SonarQube, OWASP Dependency-Check, or similar SAST, DAST, SCA, and secret-scanning tools.

• Desired certifications include CISSP, CSSLP, CASE, OSCP, or OSWE.

• Excellent communication, teamwork, and critical-thinking abilities.

• Ability to maintain a secure, focused remote workspace with reliable internet connectivity.

• Capability to utilize standard office equipment and occasionally lift up to 15 pounds.

🏝️ Benefits

• Competitive wages.

• Comprehensive healthcare benefits (medical, dental, vision, prescription drugs, FSAs).

• 401(k) retirement plan.

• Paid time off (PTO) and holidays.

• Paid parental leave.

• Life and disability insurance.

• Employee Assistance Program (EAP).

• Opportunities for professional development and tuition assistance.

• Annual discretionary bonus.

• Flexible remote work environment.

• Occasional travel may be necessary for meetings, training, or business needs (up to 10%).