Application Security Engineer

Title: Application Security Engineer Location: Philadelphia, PA / Hybrid Employment: (6-month CTH) About the Role Application development at Client is distributed across many engineering teams, and the company is modernizing its application portfolio and migrating workloads to the cloud. The mission is to create scalable application security capability. A minimum baseline that every development team can meet, a risk-tiering model that focuses limited effort where it matters most, automated security testing integrated into delivery pipelines, and a Security Champions network that extends security practice into the teams where code is actually written. Success is measured by the capability adopted across engineering teams, not by the volume of reviews one person performs. This role bridges shift-left secure development practice with detection and response capabilities that reveal how applications are attacked in the real world, which grounds the engineer's secure-design guidance in genuine attack patterns and makes them a stronger partner to the teams rebuilding applications for the cloud. This is a hands-on technical role. Expect to read unfamiliar codebases, configure tooling, lead design reviews, and triage findings. The measure of success is the operating model built and adopted across the organization, not personal throughput. What You'll Do Inventory and assess the environment by cataloging applications, development pipelines, source repositories, and existing AppSec tooling across the decentralized engineering organization, so standardization starts from an accurate picture rather than an assumption. Create an application risk-tiering model that focuses limited application security effort on the applications carrying the most risk, so time is spent where it changes outcomes. Define a minimum AppSec baseline that every development team is expected to meet, regardless of their tooling or SDLC, and socialize it with engineering leadership as the common standard. Build and lead a Security Champions program across the decentralized product engineering teams. Lead threat modeling for modernization and migration including the new trust boundaries and attack surfaces introduced by monolith-to-microservices re-architecture containerization, and re-platforming. Provide secure-by-design guidance on migration decisions so security tradeoffs are understood before architecture is locked. Own application inventory, risk-tiering, and coverage metrics, alongside vulnerability and remediation metrics, so leadership can see reach and gaps across the portfolio. Triage and validate vulnerabilities surfaced through tooling, penetration tests, bug bounty submissions, and detection alerts, and drive remediation with the responsible engineering teams. Partner with Security Operations and incident response on application-layer incidents, providing technical depth on attack paths, exploit feasibility, and remediation validation. What You Bring 4+ years in software engineering, cloud engineering, or application security, including hands-on security work. Experience wit hthreat modeling (STRIDE, PASTA, or equivalent), or a strong demonstrated ability to translate findings into engineering action. Strong software or cloud engineering ability paired with real, load-bearing security instincts. Enough application security depth to define what good looks like, including OWASP Top 10, OWASP ASVS, CWE Top 25, and modern attack patterns against web applications, APIs, and cloud-native services. Experience integrating security tooling into CI/CD pipelines (GitHub Actions, Azure DevOps, GitLab CI, Jenkins, or equivalent). Working knowledge of authentication and authorization patterns, including OAuth 2.0, OIDC, SAML, and modern session management. Ability to communicate risk and remediation guidance to engineering audiences in language they will accept and act on. Familiarity with containerization and cloud-native design (Docker, Kubernetes, etc.) and their security considerations. Ability to win credibility with engineers and communicate risk in language they will act on. Bachelor's degree in computer science, information security, or a related field, or equivalent practical experience. Nice to Have Experience working with code scanner platforms such as Fortify, Veracode, or Wiz Code Cloud security experience in Azure and AWS, including hands-on time with CSPM and CNAPP tooling such as Wiz. Exposure to API security testing, runtime application protection, and modern WAF tuning. Industry certifications such as OSCP, OSWE, GWAPT, GPEN, or CISSP. Experience with software supply chain security frameworks (SLSA, S2C2F, OpenSSF Scorecard). Prior work in a distributed, multi-tenant, or franchise-like operational environment. Medical, dental, and vision insurance are available to qualified candidates who meet eligibility requirements. The Judge Group