Application Security Engineer

Job Title: Application Security Engineer

Location: Philadelphia, PA 19103 (Hybrid)

Type: 6-Month Contract-to-Hire (CTH)

Job Summary

We are seeking an  Application Security Engineer to join our Cyber Defense & Engineering (CDE) team who will be responsible to establish, scale, and own the Application Security operating model across a decentralized product engineering organization undergoing cloud modernization. They will be focused on creating a scalable AppSec capability rather than managing a legacy program. They will design risk-tiering frameworks, integrate automated security gates into CI/CD pipelines, lead threat modeling for cloud migrations, and establish a Security Champions network to embed secure coding practices directly into development teams.

Key Responsibilities

• Catalog applications, development pipelines, source repositories, and existing security tools across decentralized teams to establish an accurate baseline.
• Create and deploy a risk-tiering framework to prioritize security efforts and resources on high-risk applications.
• Define, publish, and socialize a minimum application security baseline across engineering leadership regardless of team tooling or SDLC variations.
• Build, launch, and lead a Security Champions network across distributed product engineering teams to scale security practices natively.
• Lead threat modeling exercises (STRIDE/PASTA) for monolith-to-microservices re-architecture, containerization, and cloud migration projects.
• Provide technical architectural guidance during cloud migration decisions to identify security trade-offs before architecture is locked.
• Integrate static and dynamic security testing tools seamlessly into CI/CD pipelines (GitHub Actions, Azure DevOps, GitLab CI, Jenkins).
• Triage, validate, and prioritize vulnerabilities from automated scanners, penetration tests, bug bounty programs, and detection alerts.
• Partner with Security Operations and Incident Response teams on application-layer incidents, analyzing attack paths and exploit feasibility.
• Define and track key performance indicators for application coverage, risk tiering, vulnerability density, and remediation velocity.
• Evaluate and enforce secure authentication and authorization implementation, including OAuth 2.0, OIDC, SAML, and session management.
• Review unfamiliar codebases across diverse languages, configure security scanning engines, and partner with developers to guide remediation.

Required Skills & Experience

• Bachelor's degree in Computer Science, Information Security, or equivalent practical experience.
• 4+ years of combined experience in software engineering, cloud engineering, or application security, including direct hands-on security responsibilities.
• Demonstrated capability in executing threat modeling frameworks (STRIDE, PASTA, or equivalent) and translating findings into actionable developer tasks.
• Strong technical depth in OWASP Top 10, OWASP ASVS, CWE Top 25, and modern attack patterns against web applications, REST APIs, and microservices.
• Experience embedding security tooling into modern CI/CD pipelines (GitHub Actions, Azure DevOps, GitLab CI, Jenkins).
• Solid working knowledge of enterprise authentication and authorization standards (OAuth 2.0, OIDC, SAML) and session security.
• Familiarity with containerization and cloud-native architecture (Docker, Kubernetes) and their associated security vectors.
• Ability to communicate risk and remediation guidance to engineering audiences in language they will accept and act on.

Preferred Qualifications

• Experience configuring and tuning enterprise code scanning platforms (Fortify, Veracode, Wiz Code).
• Exposure to Azure/AWS security controls, CSPM, and CNAPP tooling (e.g., Wiz).
• Hands-on experience with API security testing, runtime application protection (RASP), and WAF tuning.
• Active professional security certifications such as OSCP, OSWE, GWAPT, GPEN, or CISSP.
• Familiarity with supply chain security frameworks (SLSA, S2C2F, OpenSSF Scorecard).
• Prior work in a distributed, multi-tenant, or franchise-like operational environment.