Senior Application Security Engineer

Senior Application Security EngineerThe Senior Application Security Engineer is responsible for embedding security throughout the software development lifecycle across Dell Medical School's cloud, platform, and enterprise application environments, including Microsoft Azure, Adobe Experience Cloud, and other cloud platforms. This role partners with development, infrastructure, cybersecurity, clinical, research, and operational teams to strengthen application security, support secure software delivery, and reduce organizational risk while enabling innovation across academic, research, and healthcare environments.The Senior Application Security Engineer is responsible for integrating security throughout the software development lifecycle across cloud, platform, and enterprise application environments. This role leads secure code review, application security testing, vulnerability management, cloud security assessments, and secure development initiatives while partnering with development teams to ensure compliance with HIPAA, HITRUST, NIST CSF 2.0, TAC 202, and UTS 165 requirements. The position supports applications developed for academic, research, and clinical environments, including biomedical systems operating within healthcare settings.Secure Development and Code ReviewDevelop, implement, and maintain Secure Software Development Lifecycle (SSDLC) standards supporting Azure-hosted applications, Adobe Experience Cloud, and other internally managed platformsSupport secure software development for academic, research, and clinical applications, with an emphasis on higher-risk clinical systemsPerform manual and automated secure code reviews for internally developed applications, identifying vulnerabilities aligned with the OWASP Top 10 and CWE Top 25Integrate Static Application Security Testing (SAST) and Software Composition Analysis (SCA) into CI/CD pipelinesPartner with software developers to remediate vulnerabilities and promote secure coding practices through guidance and educationSecurity Testing and Vulnerability ManagementConfigure and operate Burp Suite Professional/Enterprise for Dynamic Application Security Testing (DAST) and authorized penetration testingUtilize OWASP ZAP for automated and on-demand application security scanningPerform controlled validation testing using Metasploit during authorized penetration testing engagementsTriage, prioritize, and track remediation efforts through a risk-based vulnerability management processCoordinate security testing schedules with application owners to minimize operational disruptionSupport QA and automated testing initiatives validating application security controls throughout deployment pipelinesCloud and Platform SecurityAssess Microsoft Azure and other cloud environments for security posture, including identity and access management, network segmentation, and resource-level security controlsReview Adobe Experience Cloud and SaaS/PaaS integrations to ensure secure configuration and appropriate data protectionSupport secure API design, authentication, authorization, and data validation practicesRecommend improvements that strengthen cloud and enterprise application security architectureAI, Robotics, and Biomedical Systems SecurityAssess the security of AI/ML models, data pipelines, and AI-enabled applicationsReview secure integration of generative AI tools, chatbots, and AI-driven APIs supporting institutional applicationsEvaluate security controls for robotics programming, automation platforms, and robotic process automation (RPA) solutionsSupport security assessments of biomedical systems and connected medical devices operating within clinical environmentsCollaborate with research, innovation, and clinical teams to embed secure development practices throughout AI and robotics initiativesGovernance, Risk, and ComplianceAlign application security practices with HIPAA, HITRUST CSF, NIST CSF 2.0, TAC 202, and UTS 165 requirementsSupport third-party risk assessments (TPRM) and application security reviewsParticipate in audit activities, including HITRUST readiness assessmentsDevelop and maintain application security policies, standards, and proceduresCross-Functional CollaborationPartner with Cybersecurity Analysts on threat modeling, incident response, and architecture reviews for new applications and integrationsCollaborate with the campus Information Security Office (ISO) to support application security standards, risk assessments, vulnerability management, and coordinated incident responseWork closely with Infrastructure, Development, and Platform Engineering teams to integrate security throughout project lifecyclesCommunicate technical findings, security risks, and recommendations to technical and executive stakeholdersMarginal or Periodic FunctionsAdhere to internal controls and reporting structurePerform related duties as assignedKnowledge, Skills, and AbilitiesTech SavvyMaintain current knowledge of secure software development, cloud security, application security testing, and emerging cybersecurity technologiesEvaluate new tools and technologies that strengthen enterprise application securityApply modern security practices across cloud, application, and software development environmentsDecision QualityMake sound security decisions balancing organizational risk, operational needs, and regulatory requirementsEvaluate vulnerabilities and recommend practical remediation strategiesPrioritize security initiatives using risk-based methodologiesManages ComplexityNavigate complex cloud, application, and healthcare technology environmentsBalance multiple priorities across development, security, and operational initiativesIntegrate security controls into rapidly evolving technology ecosystemsCollaboratesBuild productive working relationships with development, infrastructure, cybersecurity, clinical, research, and operational teamsPromote security awareness and secure development practices throughout the organizationFacilitate collaboration across multidisciplinary technical teamsAction OrientedTake ownership of application security initiatives and vulnerability remediation effortsDrive continuous improvement of secure development practicesRespond proactively to emerging application security risksEnsures AccountabilityMaintain accountability for application security standards and vulnerability management activitiesPromote compliance with organizational security policies and regulatory requirementsSupport secure software delivery through consistent governance and oversightCommunicates EffectivelyCommunicate technical concepts clearly to both technical and non-technical audiencesPresent security findings, recommendations, and risk assessments effectivelyDevelop documentation supporting secure development and application security best practicesRequired QualificationsBachelor's degree in Computer Science, Information Security, Cybersecurity, Software Engineering, or a related field; or an equivalent combination of education and professional experienceMinimum of eight (8) years of experience in application security, secure code review, penetration testing, or secure software developmentHands-on experience using Burp Suite, OWASP ZAP, and Metasploit for application security testing and vulnerability validationExperience with Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) tools such as Checkmarx, Veracode, SonarQube, or similar platformsExperience securing Microsoft Azure and other cloud environmentsExperience implementing secure coding practices across common programming languages and web application frameworksKnowledge of Secure Software Development Lifecycle (SSDLC) methodologiesStrong analytical, troubleshooting, and problem-solving skillsExcellent verbal and written communication skillsAbility to collaborate effectively with software developers, infrastructure teams, cybersecurity professionals, and business stakeholdersPreferred QualificationsExperience supporting healthcare or higher education environmentsKnowledge of HIPAA, HITRUST, NIST CSF 2.0, TAC 202, and UTS 165 security frameworksExperience securing Microsoft Azure, Adobe Experience Cloud, SaaS/PaaS platforms, and cloud-native applicationsFamiliarity with AI/ML security concepts, including model security, data governance, prompt injection risks, and adversarial attacksExperience supporting robotics, robotic process automation (RPA), biomedical systems, or connected medical devicesExperience integrating application security testing into QA processes, automated testing frameworks, and CI/CD pipelinesExperience performing application threat modeling, secure architecture reviews, and third-party risk assessments (TPRM)Licenses/Registrations/Certifications The University of Texas at Austin Staff