Application Security Engineer

Dive deep into Digital! For 20 years Intellias has been developing top-tier digital solutions for the world’s leading companies, keeping them in line with the latest technology trends. Join in and provide innovations for the future!

What project we have for you

The Application Security Engineer maintains independence from the development teams, reporting to our Cybersecurity Business Analyst, but would spend most of their time working with the Dev and DevOps teams. Their focus would be:

• Implementing and configuring SAST (static application security testing) and DAST (dynamic application security testing) across our web properties, including TOA, APIs, AFB, and the Project One stack.
• Integrating security checks into our CI/CD pipelines.
• Working with the teams to ensure secrets are handled securely and building rotation practices in line with our policies and standards.
• Helping teams understand, prioritize, and remediate the findings these tools produce.

What you will do

• Select, deploy, and tune SAST tooling across our repositories, integrating scans into pull requests and CI/CD pipelines with practical quality gates.
• Implement and operate DAST scanning against our web applications and APIs in staging and production-like environments.
• Add software composition analysis and dependency scanning to track vulnerable open-source components.
• Reduce false positives and alert fatigue through rule tuning, baselining, and severity thresholds so developers trust the results and act on them.
• Recommend and implement secrets management solutions and practices that align with our existing policies and standards for storing, distributing, rotating, and auditing secrets.
• Deploy secret scanning in repositories, commit hooks, and pipelines to catch hardcoded credentials before they ship, and partner with DevOps to remove long-lived credentials from pipelines, configurations, and infrastructure-as-code.
• Lead the response when secrets are exposed: revoke, rotate, assess impact, and fix the root cause.
• Triage findings from scanners, penetration tests, external reports, and internal reviews, prioritizing by exploitability, exposure, and business impact rather than raw severity scores.
• Work directly with developers and DevOps engineers to understand root causes, propose practical fixes, and agree on realistic remediation timelines.
• Track findings to closure in the teams’ existing workflow tools, and define and enforce remediation SLAs by severity.
• Identify recurring vulnerability patterns and address them at the source through shared libraries, secure defaults, and pipeline guardrails.
• Perform manual code reviews and targeted security testing on high-risk features such as authentication, file uploads, and APIs.
• Provide clear, actionable remediation guidance with code-level examples, and contribute to secure coding standards aligned to OWASP Top 10 and ASVS.
• Participate in design and architecture discussions to provide security input and threat modeling for new features and services.
• Build the roadmap, processes, and tooling strategy for a new application security function, including build-versus-buy recommendations and vendor evaluations.
• Define and report application security metrics to security leadership, such as scan coverage, mean time to remediate, and open critical and high findings.
• Support audit and compliance requirements related to secure development, and contribute to incident response for application-layer security events.

What you need for this

Required Qualifications:

• BA/BS in Computer Science, Information Technology, Cybersecurity, or a related field, with 5+ years of experience in application security, product security, or a security-focused engineering role, or equivalent practical experience.
• Hands-on experience deploying and operating SAST and DAST tools in CI/CD pipelines, including tuning them for accuracy.
• Experience implementing secrets management and secret scanning in a production environment.
• Strong knowledge of web application vulnerabilities (OWASP Top 10, CWE Top 25) and how to remediate them in code.
• Working knowledge of authentication and identity management workflows and protocols (e.g., SAML, OAuth 2.0, OpenID Connect, SSO, session management) and the common security flaws in how they are implemented.
• Ability to read and review code in at least one modern language (e.g., Python, JavaScript/TypeScript, Java, C#, Go).
• Working knowledge of CI/CD platforms (e.g., GitHub Actions, GitLab CI, Jenkins) and DevOps practices.
• Demonstrated experience working with developers to fix security issues, not just report them.

Preferred Qualifications:

• Experience building or significantly maturing an application security program from scratch.
• Experience with threat modeling methodologies such as STRIDE or PASTA.
• Experience with cloud and container security (e.g., Microsoft Azure, AWS, or GCP; Docker and Kubernetes).
• Experience with infrastructure-as-code security scanning and API security testing.
• Experience evaluating security tooling, including build-versus-buy decisions.
• Familiarity with security compliance frameworks such as SOC 2, and with supply chain security concepts such as SBOMs and SLSA.
• Relevant certifications such as GWAPT, OSWE, CSSLP, or equivalent.

Skills & Competencies:

• Strong systems thinking, with the ability to embed security controls into engineering workflows without slowing teams down.
• Sound judgment to prioritize findings based on real risk and to explain trade-offs to both engineers and leadership.
• Excellent written and verbal communication, with the ability to produce clear, actionable remediation guidance and documentation.
• Collaborative, pragmatic approach to influencing teams without direct authority.
• Ability to move effectively between hands-on technical work and program-level planning.
• Ability to work independently and drive initiatives through ambiguity in a function that is new to the organization.

What it’s like to work at Intellias

At Intellias, where technology takes center stage, people always come before processes. By creating a comfortable atmosphere in our team, we empower individuals to unlock their true potential and achieve extraordinary results. That’s why we offer a range of benefits that support your well-being and charge your professional growth.
We are committed to fostering equity, diversity, and inclusion as an equal opportunity employer. All applicants will be considered for employment without discrimination based on race, color, religion, age, gender, nationality, disability, sexual orientation, gender identity or expression, veteran status, or any other characteristic protected by applicable law.
We welcome and celebrate the uniqueness of every individual. Join Intellias for a career where your perspectives and contributions are vital to our shared success.