Senior Application Security Engineer Consultant (Indianapolis)

IWU is seeking a Senior Application Security Engineer Consultant (Independent Contractor ‑ 1099 / Contract-to-Hire) for a large-scale technology reorganization project.

ABOUT IWU TECHNOLOGY

ABOUT THE ROLE:

• IWU is re-platforming its enterprise on a multi-site, active/active data center foundation and an AI-first application stack . Security must be embedded in how software is designed, built, tested, and shipped – not bolted on after release. We are seeking a Senior Application Security Engineer Consultant with deep AI application security experience to stand up secure SDLC practices, integrate security tooling into CI/CD pipelines, and partner with development teams building traditional applications and AI-native services alike.
• This is not a cloud AppSec role . IWU runs workloads on infrastructure we own and operate in commercial colocation, with Microsoft Entra ID as our only sanctioned external service. You will embed security into on-premises pipelines – source control, build systems, artifact registries, Kubernetes deployments, and API gateways – while addressing threats unique to LLM applications : prompt injection, insecure output handling, excessive agency, training-data leakage, and model supply-chain risk.
• You will be a hands-on senior individual contributor : you will translate industry application security standards into pipeline gates and developer guardrails, perform threat modeling and code review for high-risk changes, mentor engineers on secure coding, and partner with IAM, the Enterprise AI Architect, and platform teams to keep our re-platforming program auditable and defensible.

Secure SDLC and Developer Enablement

• Recommend and implement the secure software development lifecycle (SSDLC) – requirements, design review, implementation, verification, release, and maintenance – aligned to organizational standards and ITIL change control.
• Publish secure coding standards and language-specific guidance (.NET, Python, JavaScript/TypeScript, React, SQL) that development teams can adopt without slowing delivery.
• Lead threat modeling sessions (STRIDE, PASTA, or equivalent) for new features, integrations, and AI workflows – document trust boundaries, data flows, and mitigations before code ships.
• Run security design and architecture reviews for application , API, and microservice changes – partner with solution designers and tech leads on trade-offs that are secure and shippable.
• Build developer security training – onboarding modules, lunch-and-learns, and just-in-time guidance tied to real findings from our codebase.

AI Application and LLM Security

• Establish AI/LLM application security standards in partnership with the Enterprise AI Architect – OWASP LLM Top 10 mitigations, prompt and output guardrails, tool-use authorization, and human-in-the-loop controls for high-risk actions.
• Review RAG and agent architectures for data exfiltration, prompt injection, indirect prompt injection, and cross-tenant leakage – embedding pipelines, vector store access controls, and retrieval boundaries.
• Partner on AI observability and logging for security – prompt/output retention policies, audit trails, content filtering events, and evidence collection for governance reviews.

Identity, API, and Data Protection

• Partner with IAM on application authentication and authorization patterns – OIDC/SAML integration, OAuth scopes, service accounts, workload identity, and least-privilege API access aligned to Entra ID and on-premises IdP standards.
• Ensure applications handle regulated and sensitive data appropriately – FERPA, HIPAA, PCI-DSS, and SOC 2 controls for encryption at rest and in transit, logging, retention, and access auditing.
• Coordinate with Database and Data Platform teams on SQL injection prevention, parameterized queries, ORM safety, and secure access to vector and relational stores.

Incident Response and Governance

• Participate in security incident response for application-layer events – credential compromise, injection attacks, dependency exploits, and AI-specific abuse – with runbooks and post-incident review.
• Contribute audit and compliance evidence – SSDLC artifacts, scan results, remediation SLAs, and penetration test closure reports for SOC 2, SOX, and institutional audits.
• Align with ITIL change and problem management – security defects tracked to root cause, not one-off hotfixes that return next sprint.

WHAT WE ARE LOOKING FOR:

Required

• According to Indiana Wesleyan University policy, all employees and contract-to-hire contractors must possess a strong Christian commitment and adhere to the standards outlined in the IWU Community Lifestyle Statement .
• 5+ years of progressive experience in application security , secure software development, or security engineering, with 2+ years embedding security into CI/CD and developer workflows.
• Strong secure coding foundation – common vulnerability classes (injection, XSS, CSRF, SSRF, deserialization, auth flaws) and how to prevent them in modern web and API stacks.
• Experience with threat modeling and security architecture review for distributed applications – microservices, APIs, message queues, and event-driven integrations.
• Hands-on familiarity with containers and Kubernetes security – image scanning, pod security standards, network policies, secrets management, and deployment hardening.
• Working knowledge of AI/LLM application security – OWASP LLM Top 10, prompt injection mitigations, RAG security considerations, and guardrail patterns for production LLM features.
• Experience supporting compliance-driven development – SOC 2, SOX, HIPAA, PCI-DSS, or FERPA-aligned controls with audit-ready documentation.
• Bachelor's degree in Information Security, Computer Science, or a related field – or equivalent demonstrated experience .

Strongly Preferred

• Experience securing on-premises or colocation application platforms – not solely SaaS or hyperscaler-native deployments.
• Hands-on development background in .NET, Python, or JavaScript/TypeScript/Node/React – you have shipped code and know where developers cut corners under deadline pressure.
• Experience with API gateways, service meshes, and zero-trust application patterns in Kubernetes.
• Familiarity with Microsoft Entra ID application integration – app registrations, OAuth/OIDC flows, conditional access implications for custom apps.
• Experience with AI agent and orchestration frameworks and their security operational realities.
• Background in red teaming, penetration testing coordination, or bug bounty program support – you can read a finding and know whether the fix is real.
• Relevant certifications (CSSLP, GWAPT, OSWE, SC-200, or equivalent demonstrated depth).

How You Work

• You prioritize risk over checkbox compliance – not every finding deserves a Sev-1, and not every audit control deserves a bespoke spreadsheet.
• You automate repeatable checks and reserve human review for judgment calls – architecture, AI abuse cases, and novel integration risk.
• You stay current on AI security research and OWASP guidance – the threat model for LLM applications is evolving monthly, and you translate that into practical standards.

WHY THIS ROLE?

• Foundational impact . Application security is on the critical path for enterprise re-platforming, AI-native products, and integration hub delivery – every team ships through the standards you help define.
• AI-native scope . You are not retrofitting AppSec onto a legacy monolith only – you will shape security for RAG, agents, and model-serving workloads from early design.
• Cross-functional seat . You work with Security, IAM, AI Architecture, Data, and Software Engineering – broad visibility and direct influence on how the re-platforming ships safely.
• Mission and meaning . IWU is a century-old Christ-centered university serving roughly 15,000 learners. The applications you help secure carry their data, their progress, and their trust.

PROJECT REMUNERATION:

Estimated annual project remuneration is $155,000 - $175,000 for this independent contractor (1099) / Contract-to-Hire role.

Contractor Insurance/Bond Requirements

• General Liability: $1m per occurrence / $2m aggregate
• Cyber Liability: $2m per occurrence
• Workers’ Compensation / Employers’ Liability: $500,000; not applicable for approved sole operators
• Professional Liability / Errors & Omissions: $1m per occurrence / $3m aggregate

Equipment & Travel Expenses

• IWU