Application Security Engineer

Role overview

This role strengthens application security across software systems and delivery environments. You’ll assess applications and their dependencies, help teams fix security issues, and improve how security checks are built into development and release workflows. You’ll also create reusable examples and small tools that make secure practices easier to adopt.

Responsibilities

- Assess web applications, APIs, services, containers, dependencies, and delivery environments for vulnerabilities. - Support automated security scanning and maintain scanning tools used across development, build, test, release, and runtime activities. - Triage and track findings, document remediation evidence, and validate fixes through closure. - Explain scan results and secure coding practices to development teams, and guide them through remediation. - Integrate security controls into CI/CD pipelines, including automated checks, policy enforcement, reporting, and API-based tool integrations. - Build proof-of-concept applications, reusable security patterns, scripts, dashboards, or other utilities that improve security operations.

Requirements

- Bachelor’s degree in IT, computer science, cybersecurity, engineering, or a related field. - At least four years of professional IT experience and four years supporting application security, cybersecurity, DevSecOps, or closely related work. - Practical experience with application security testing, vulnerability assessment, secure coding, and remediation guidance. - Familiarity with SAST, DAST, software composition analysis, container scanning, dependency security, and CI/CD security integration. - Experience managing vulnerabilities from triage and documentation through remediation, validation, and closure. - Ability to provide technical analysis and guidance and work effectively with development, security, platform, and operations teams.

Nice to have

Experience with security tools such as SonarQube, Nexus IQ, Checkmarx, or Twistlock; dependency policies and CVE analysis; Kubernetes; CI/CD platforms; or observability tools. Familiarity with OWASP, Zero Trust, NIST, CISA, or CIS guidance is useful. Experience building sample applications or API integrations in common programming stacks is also relevant.

Benefits and work setup

The position is remote. Candidates must be willing to undergo a government background investigation.