Application Security Engineer

Quick Facts

• Role: Application Security Engineer

• Focus: Security-by-design and proactive application security across the SDLC

• Key tech areas: .NET, Angular, REST APIs, authentication/authorization

Description

You will help embed security into the software development lifecycle using a shift-left approach, moving beyond traditional vulnerability management. The role includes improving the application security posture, managing and triaging findings from security testing and assessments, and automating security controls in CI/CD pipelines. You’ll provide guidance on securing modern web applications, APIs, authentication mechanisms, and cloud-native architectures.

Responsibilities

• Own and continuously improve application security posture across internally developed solutions.

• Monitor, assess, prioritize, and manage application security vulnerabilities and ensure remediation within SLAs.

• Triage security findings to determine business risk, remediation needs, and false positives with technical justification.

• Design and implement scalable security controls and automation to reduce recurring vulnerabilities.

• Integrate automated security testing, policy enforcement, and secure practices into CI/CD pipelines.

• Identify recurring vulnerability patterns and implement preventative controls, secure frameworks, and developer guardrails.

• Act as the liaison for external penetration testing providers and ensure timely, actionable, risk-based outcomes.

• Partner with Group Security to maintain a single source of truth for vulnerabilities and resolve disputes.

• Serve as Application Security subject matter expert for solution delivery and promote secure design.

• Maintain security standards and processes in line with OWASP and NIST best practices.

• Monitor emerging threats and OWASP Top 10 trends; stay current with security tooling innovations.

• Deliver secure coding and security awareness guidance to developers and delivery teams.

• Provide governance updates on posture, vulnerability trends, remediation performance, and risk reduction.

Requirements

• Practical knowledge of OWASP Top 10 and common web application attack vectors.

• Deep understanding of securing modern web applications and REST APIs, including OAuth2, OIDC, and JWT.

• Experience implementing and managing SAST, DAST, SCA, API security, and penetration testing programs.

• Experience automating security controls within CI/CD.

• Strong secure software engineering and secure-by-design knowledge.

• Experience with .NET, Angular, JavaScript/TypeScript, and modern web architectures.

• Ability to focus on strategic security improvements as well as remediation.

• Strong stakeholder management and influence skills.

• Excellent analytical, problem-solving, and communication skills.

Benefits

• Influence technology solutions and product direction.

• Ambitious projects with autonomy and responsibility.

• Stable, long-term assignment with flexible hours and a hybrid work model.