Senior Application Security Engineer – DevSecOps, CICD

This is a fully remote position, open to applicants in Colorado, +2 more states.

📋 Description

• Integrate application security into the Software Development Life Cycle (SDLC) by defining and enhancing security processes, standards, workflows, and the Definition of Done criteria.

• Conduct both AI-assisted and traditional security evaluations of applications, APIs, cloud workloads, repositories, and their supporting infrastructure.

• Oversee repository scanning coverage, which includes source code analysis, secret scanning, dependency analysis, and infrastructure reviews.

• Assess findings based on exploitability, business impact, and severity.

• Facilitate the remediation process from discovery to verified closure.

• Mitigate security debt, dependency vulnerabilities, and software supply chain risks across the application portfolio.

• Develop security metrics, coverage reports, and executive dashboards.

• Advocate for a security-first culture through coaching, knowledge sharing, and the documentation of best practices.

• Review and assess new findings from Static Application Security Testing (SAST), Software Composition Analysis (SCA), secret scanning, and dependency analysis.

• Perform manual validation and security testing using tools such as Burp Suite, browser developer tools, API testing platforms, and secure code reviews.

• Create and refine backlog items, assign ownership, retest fixes, collect evidence, and confirm closure.

• Engage in Scrum ceremonies and manage Agile work items, user stories, tasks, and defects.

• Collaborate with application teams on code corrections, configuration modifications, infrastructure updates, and compensating controls.

• Execute ongoing security assessments and enhance processes and standards.

• Utilize AI tools responsibly for analysis, threat modeling, code review, and documentation within governance frameworks.

• Monitor emerging threats and security risks related to AI.

⛳️ Requirements

• Bachelor’s degree in Computer Science, Cybersecurity, Information Systems, or a related discipline.

• 5–7 years of practical experience in application security/DevSecOps.

• 5–7 years of experience with Secure SDLC, DevSecOps, Agile, and Scrum methodologies.

• 5–7 years of experience with various security tools.

• Strong working knowledge of Secure SDLC, DevSecOps, Agile, and Scrum methodologies.

• Proficiency with Burp Suite, GitHub Advanced Security, CodeQL, SAST, SCA, secret scanning, dependency analysis, and CI/CD security tools.

• Capability to read, analyze, test, and modify production application code in Java and Python.

• Familiarity with OWASP Top 10, API Security Top 10, authentication/authorization controls, secure coding practices, and common attack methodologies.

• Understanding of cloud security, identity and access management, and modern application architectures.

• Ability to effectively and safely utilize AI-assisted development and security tools.

• Experience in vulnerability triage and validation, assessing exploitability, business impact, severity, compensating controls, and providing remediation guidance.

• Experience in developing security metrics, coverage reports, and executive dashboards.

• Exceptional communication, stakeholder management, presentation, and documentation abilities.

• Capacity to work independently across multiple applications, teams, portfolios, and technology stacks.

• Strong problem-solving skills that balance security, usability, operational impact, and business goals.

• Ability to collaborate with and influence architects, developers, DevOps, product owners, and business stakeholders.

• Capacity to coach colleagues and share knowledge effectively.

• Comfort in operating within Scrum/Agile delivery frameworks and managing personal work items.

🏝️ Benefits

• Contract engagement with an estimated duration of 12+ months.