Application Security Engineer

Job Description

Role : ASC Champions / Application Security Center

\n

Location : Charlotte, NC (Hybrid)

\n

Type : Contract

\n

\n

Must have : App Security, App Development, Risk, Vulnerability

\n

• Minimum 10+ years of relevant experience.

\n

• Strong security and vulnerability expertise across application and infrastructure layers.

\n

• Proficiency in Application Development, Application Security, and Security Services.

\n

• Solid understanding of Risk Management, Vulnerability Assessment, and Remediation.

\n

• Expertise in SDLC (Software Development Lifecycle) and Product Lifecycle Support.

\n

• Infrastructure and application security knowledge at a senior/lead level.

\n

• Go-getter attitude with ability to manage large, complex platform portfolios.

\n

• Familiarity with CISO organization structure and enterprise security governance.

\n

\n

Required Qualifications

\n

• 10+ years of experience in application security, application development, or related cybersecurity roles.

\n

• Deep expertise in application security (SAST, DAST, SCA), vulnerability management, and secure SDLC.

\n

• Strong knowledge of security risk frameworks (NIST, ISO 27001, OWASP, PCI-DSS, SOX).

\n

• Hands-on experience with application development (Java, Python, .NET, or similar) enabling effective security partnership with dev teams.

\n

• Demonstrated experience in vulnerability triage, risk scoring (CVSS), and remediation tracking.

\n

• Familiarity with cloud platforms (AWS, Azure, GCP) and container/Kubernetes security.

\n

• Excellent stakeholder management and communication skills; ability to influence without direct authority.

\n

• Experience in financial services or banking industry strongly preferred.

\n

\n

Preferred Qualifications

\n

• Certified Information Systems Security Professional (CISSP), Certified Application Security Engineer (CASE), or CSSLP.

\n

• Experience working in a large enterprise banking environment with multiple business units.

\n

• Familiarity with DevSecOps toolchains (Jenkins, GitHub Actions, SonarQube, Veracode, Checkmarx, Snyk).