Application Security Engineer

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for an Application Security Engineer based in the United States. As an Application Security Engineer, you will strengthen application security across a high-scale payment technology platform supporting modern commerce and financial innovation. You will collaborate closely with Security and Engineering teams to integrate security practices seamlessly into the software development lifecycle. Your work will focus on automating security controls, identifying vulnerabilities early, and building scalable safeguards across CI/CD pipelines. You will help shape secure development standards, lead threat modeling activities, and improve the organization's vulnerability management capabilities. Beyond technical implementation, you will empower developers through security training and foster a strong culture of shared security ownership. Working within a remote-first, globally distributed environment, you will have the opportunity to influence security strategy and drive meaningful improvements. This role is ideal for a proactive security professional passionate about application protection, developer enablement, and securing payment technologies at scale. Accountabilities: - Integrate and automate application security tools, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA), into CI/CD pipelines using platforms such as GitHub and GitLab. - Design, implement, communicate, and maintain a developer-friendly Secure Software Development Lifecycle (Secure SDLC), incorporating security best practices and practical development guidelines. - Conduct threat modeling exercises using established frameworks such as STRIDE to identify potential attack vectors, assess risks, and recommend appropriate mitigation strategies.

- Perform application security reviews and secure code assessments for Java and Python microservices, identifying vulnerabilities and providing actionable remediation guidance. - Lead the management and continuous improvement of the private bug bounty program, including tracking program expenditure, triaging vulnerability reports, monitoring performance metrics, and reducing Mean Time to Mitigation (MTTM). - Evaluate, configure, and optimize security tooling, including solutions such as GitHub Advanced Security, OWASP ZAP, Burp Suite, Synopsys, Veracode, and Semgrep. - Establish and maintain security program metrics and key performance indicators (KPIs) to measure effectiveness, track remediation progress, and identify opportunities for improvement. - Develop and deliver secure coding training, practical guidance, and awareness initiatives to help engineers integrate security into their daily workflows. - Build and support a Security Champions network across Engineering, encouraging shared responsibility for security and strengthening collaboration between technical teams. - Partner with internal stakeholders to manage vulnerability disclosures and contribute technical content, including security engineering blogs and communications that demonstrate security expertise. - Collaborate with engineering teams to introduce scalable security guardrails while minimizing friction and supporting development speed and productivity. - Stay informed about emerging application security threats, vulnerabilities, and industry best practices to continuously improve security processes and controls. Requirements: - Three to five or more years of dedicated experience in application security and/or full-stack development, with demonstrated expertise in identifying and mitigating software vulnerabilities. - Practical experience performing secure code reviews and application security assessments for Java and Python applications.