Application Security Engineer

Role Description

The Application Security Engineer plays a crucial role in securing our growing portfolio of applications. This role will focus on integrating security best practices into the Software Development Lifecycle (SDLC), ensuring compliance with regulatory requirements, proactively mitigating threats, and collaborating closely with developers to enhance the overall security posture of our applications.

• Partner with development teams to embed security best practices across the SDLC, including design, development, and deployment, and provide secure coding guidance.
• Conduct threat modeling and security architecture reviews to identify design-level risks and implement appropriate security controls.
• Identify, assess, and mitigate application vulnerabilities through a combination of automated (SAST/DAST) and manual code reviews, as well as penetration testing, and drive risk-based remediation.
• Implement and manage application security tools, including SAST, DAST, Software Composition Analysis (SCA), and other security scanning solutions.
• Ensure application security practices align with regulatory standards such as NYDFS, NIST, and OWASP guidelines.
• Partner with DevOps, IT, and security teams to integrate security into CI/CD pipelines and engineering workflows.
• Design and oversee the implementation of authentication, authorization, and access control mechanisms for APIs and platforms.
• Develop and enforce secure usage standards and governance for AI tools and AI-generated code, addressing risks such as prompt injection, data leakage, insecure code generation, and model misuse, while aligning with regulatory and industry standards.

Qualifications

• 5+ years of experience in application security, secure software development, and vulnerability management.
• Strong knowledge of secure coding practices, OWASP Top 10, OWASP Top 10 for LLMs, MITRE ATLAS, and common security vulnerabilities.
• Experience with containerization technologies such as Docker and Kubernetes, the principles of container operation, and their secure interaction.
• Experience with security testing tools (e.g., Burp Suite, Fortify, Veracode, or similar).
• Experience with Black Duck/Polaris with Apex code (Salesforce) is a plus.
• Familiarity with DevSecOps principles and integrating security into CI/CD pipelines.
• Direct experience with security tools such as vulnerability scanners, intrusion detection systems, and log analysis tools.
• Understanding of regulatory frameworks and compliance requirements (e.g., NYDFS, GDPR, SOC 2).
• Ability in scripting and automation using languages such as Python, PowerShell, or Bash and leverage AI driven tools to streamline and enhance security process and workflows.
• Relevant certifications such as Certified DevSecOps Engineer, CISSP, OWASP certifications, GIAC GWAPT.

Company Description

H.W. Kaufman Group is a powerful global network of companies dedicated to shaping the future of insurance. With thousands of dedicated professionals across an extensive network of over 60 offices around the world, we lead by offering innovative solutions that are at the forefront of the industry. We are privately owned and thus free from the influence of Wall Street. This allows us the ability to adapt to constantly fluctuating market conditions. From brokerage, underwriting, and real estate to claims, loss control and risk management services, our depth of services is unrivaled.

Equal Opportunity Employer

The H.W. Kaufman Group of companies is an equal opportunity employer. All employment decisions are based on business needs, job requirements and individual qualifications, without regard to race, color, religion, gender, gender identity, age, national origin, disability, veteran status, marital status, pregnancy, sexual orientation, genetic information or any other status or condition protected by the laws or regulations in the locations where we operate.

In addition, Kaufman will make reasonable accommodations to known physical or mental limitations of an otherwise qualified person with a disability, unless the accommodation would impose an undue hardship on the operation of our business.