Application Security Engineer

About the role

Application Security Engineer – Hybrid (New York, NY or Charlotte, NC) – Contract position. This role is a key contributor to an enterprise-wide application security program, focusing on discovering, inventorying, and securing business applications across multiple units. The position involves implementing advanced security tooling, integrating AI-assisted workflows, and collaborating closely with development teams to embed security into the SDLC.

Delphi-US is a national IT Services firm based in Newport, Rhode Island. Delphi attracts our nation's best and brightest Technical & Professional Talent and positions our nation's finest employers to further their competitive advantages. Delphi's core technical focus includes Data Intelligence Engineering & Analytics, AI/ML Operational Excellence, DevOps & Cloud Computing, Health IT & Life Sciences, and Energy Management/Power Systems; serving domains from sensitive national energy sectors to critical financial services, biomed, life sciences & pharma, major government & municipal institutions, and much of the USA's Fortune 500 corporations. Delphi Associates are deployed on critical IT Projects where their consultative business acumen, comprehensive technical expertise, and committed service mission drives our client's success. Our proprietary skill-based and cultural matching process results in higher qualified project teams, custom curated for our client's specific technical & functional goals. We are supremely experienced, friendly, professional, and ready to advocate on your behalf. Delphi has an indelible understanding of employer expectations, a track record of project success and we deliver lasting results.

Responsibilities

• Leads the discovery and inventory of applications across all business units, including ownership mapping, technology stack profiling, and risk tiering.
• Stands up and operates the application security tooling stack, including SAST, SCA, secrets scanning, and container/IaC scanning, integrated into CI/CD pipelines.
• Designs and implements AI-assisted triage workflows to manage security findings, reducing developer overload and filtering false positives.
• Defines secure SDLC requirements, threat modeling practices, and security gates adopted by business units.
• Partners with development leaders to build relationships and operationalize application security practices without impeding delivery timelines.
• Contributes to AI security strategy by evaluating emerging tools such as AI code review assistants and automated security testing solutions, recommending operationalization strategies.
• Produces executive-ready metrics and reports that demonstrate how application security activities mitigate business risks.

Requirements

• 7+ years in application security, product security, or security engineering, with experience working across multiple independent business units or product lines.
• Hands-on experience deploying and managing modern application security tools such as Semgrep, Snyk, Checkmarx, Veracode, Apiiro, Ox Security, or GitHub Advanced Security.
• Proficiency in at least three programming languages (e.g., Python, JavaScript/TypeScript, Java, C#, Go) for reading, reviewing, and triaging security findings.
• Strong scripting and automation skills in Python or similar, with experience building integrations against REST APIs and working within CI/CD environments like GitHub Actions, GitLab CI, Jenkins, or Azure DevOps.
• Proven ability to influence engineering teams and drive security adoption without direct authority, including negotiating standards and building shared security playbooks.

Qualifications

• Experience integrating LLM-based tooling into security workflows for alert triage, finding summarization, or remediation guidance.
• Familiarity with compliance frameworks such as HITRUST, HIPAA, NIST AI RMF, or SOC 2.
• Prior experience working in regulated or healthcare-adjacent environments.
• Cloud security expertise in at least one major provider (AWS, Azure, GCP).
• Contributions to the application security community through open-source projects, conference talks, or published research.

Pay

Contract – Hourly Pay Range $60‑$70