Application Security Engineer

Role overview

Responsibilities

• Implement and maintain SAST, DAST, IAST, and SCA tools to identify code and dependency vulnerabilities.
• Implement and maintain ASPM tools to centralize and deduplicate findings from multiple solutions.
• Integrate security tooling into CI/CD pipelines and software development processes.
• Support users by resolving false positives, guiding remediation, and evaluating security exceptions.
• Develop reports on security findings and remediation efforts.
• Communicate security risks and promote secure development practices to development teams and management.
• Triage security risks at scale across varied application development environments and business units.
• Coach and support junior engineers.

Required qualifications

• Bachelor’s degree and 5 years of experience, or master’s degree and 4 years of experience.
• Experience in application security and software development.
• Experience implementing, administering, and supporting application security tooling.
• Knowledge of secure coding across multiple programming languages, especially Java and Node.js.
• Experience integrating security testing into CI/CD pipelines.
• Knowledge of OWASP Top 10, CWE, application security principles, and mitigations.
• Experience supporting developers with security finding assessment and mitigation.
• Strong technical and non-technical communication skills.
• Ability to generate original technical ideas and strategies.
• Excellent written and oral English communication skills.
• Experience coaching and supporting junior engineers.

Preferred experience

• Experience consolidating application security findings from multiple sources and integrating them with development workflows.
• Experience administering Snyk and Endor Labs.
• Experience integrating CSPM tooling with application security pipelines.
• Experience automating workflows with Python or other programming and scripting languages.
• Experience adding logging to DevSecOps pipelines.
• Experience collaborating with vulnerability and risk management partners.

Compensation and benefits

• The posting references a possible base pay range for jurisdictions with pay disclosure requirements but does not provide an amount or compensation cadence.
• Eligible employees may receive paid time off, medical, dental, vision, 401(k), and short-term incentive program participation.