Senior Application Security Engineer

Responsibilities

• Run and tune client SAST, DAST, SCA, secrets, and IaC scanning tools, triage findings, eliminate false positives, and provide prioritized remediation guidance.
• Design and implement security integrations across CI/CD pipelines, source control, IDEs, and ticketing systems, including policy gates and break-the-build criteria.
• Partner with development teams on remediation, secure coding, and developer enablement throughout the SDLC.
• Assess software supply chain controls, including SBOM generation, dependency and container image scanning, artifact signing, and pipeline or runner security.
• Perform threat modeling and security architecture reviews for cloud-native, microservice, container, and infrastructure-as-code environments.
• Use AI-assisted and agentic tooling to accelerate application security testing, triage, reporting, and remediation, and advise clients on secure AI coding-assistant adoption.
• Help mature application security programs through metrics, vulnerability-management SLAs, roadmaps, and frameworks such as OWASP SAMM, BSIMM, and NIST SSDF.
• Create client-ready deliverables, present findings to technical and executive audiences, and contribute to AppSec practice growth through tooling, methodologies, and knowledge sharing.
• Travel up to 10% as required.

Requirements

• 4–8+ years of experience in Application Security, Web Penetration Testing, DevSecOps, or security-focused agentic software development.
• Proficiency with Burp Suite Pro and strong knowledge of the OWASP Top 10 and OWASP API Security Top 10 and their mitigations.
• Strong knowledge of secure development lifecycles and experience guiding remediation of application-security findings.
• Ability to review source code in one or more of JavaScript/TypeScript, Python, Java, C#, Go, PHP, or C/C++.
• Working knowledge of AWS, Azure, or GCP, containers, and Git-based development workflows.
• Strong written and verbal communication skills for explaining complex issues to technical and executive audiences.
• Preferred experience building agentic AI workflows or security automation with Python, Bash, or PowerShell.
• Preferred experience with SBOM, SLSA, Sigstore, IaC and container security scanning, threat modeling, and AppSec maturity frameworks.
• Preferred certifications include GWAPT, OSWE, OSCP, CSSLP, Certified DevSecOps Professional, or AWS Certified Security – Specialty.
• Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent experience.

Benefits

• Primarily remote U.S.-based workforce; some travel or on-site work may be required for certain positions.
• Up to 10% travel for this role.
• Medical insurance options including a zero-deductible PPO and a high-deductible health plan with HSA contributions.
• Dental insurance with GuidePoint paying 100% of employee premiums and 75% of family premiums.
• 12 corporate holidays and a Flexible Time Off program.
• Mobile phone and home internet allowance.
• Retirement plan eligibility after two months at open enrollment.
• Pet benefit option.