Perform threat modeling (e.g., OWASP Top 10) and application/API security reviews; provide clear, relevant remediation guidance.
Design and validate application and API security controls, including authentication, authorization, encryption, and input validation.
Design and review security controls for cloud-native applications, including containerized workloads and managed cloud services.
Integrate security tooling into CI/CD pipelines (SAST, DAST, SCA, secrets, IaC scanning); implement policy-as-code and pipeline gating.
Review application source code to identify security vulnerabilities and collaborate with developers to remediate findings.
Establish and automate secure configuration baselines, drift detection, and security monitoring to support Security Operations.
Validate vulnerabilities, reduce false positives, and guide teams toward pragmatic remediation and compensating controls.
Serve as a trusted security partner to developers through guidance, reusable patterns, and enablement.

Requirements

5+ years in IT or Cybersecurity
2+ years in Application Security Engineering or DevSecOps
Experience with threat modeling, AppSec reviews, and CI/CD security integration
Experience reviewing application logic and data flows for security issues, with the ability to read and interpret source code
Experience with secure coding practices and common application/API vulnerabilities
Experience with application security testing and automation tools
Experience with networking fundamentals (TCP/IP, DNS, HTTP/S)
Experience with scripting or automation (e.g., Python, PowerShell, Bash)
Solid understanding of API security concepts and controls

Benefits

High-quality, low-deductible medical insurance
Low to no-cost dental and vision plans
5 weeks of paid time off (plus almost a dozen paid holidays)
Employer-funded retirement
Free tuition program
Parental leave
Mental health and wellbeing resources

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills & Tools

threat modelingapplication security reviewsAPI securitysecure coding practicesapplication security testingautomation toolsnetworking fundamentalsscriptingcloud-native applicationssecurity controls

Soft Skills

collaborationguidanceenablementremediation