Application Security Engineer

About the role

We seek a highly motivated and experienced Application Security Engineer to join our growing security team. This role is highly technical and candidates must possess a solid understanding of the security and privacy of our company's applications and data.

Responsibilities

• Conduct security assessments that require expertise of our organization's applications using both Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) methodologies.
• Collaborate with software development teams to integrate security into the development life cycle.
• Conduct security assessments of web, mobile, and other applications.
• Analyze security assessment results to identify security vulnerabilities and provide guidance on remediation.
• Design and implement secure software development practices, including threat modeling, secure coding standards, and code review.
• Stay current with security threats, trends, and technologies, and recommend new security controls as needed.
• Conduct application security investigations and provide recommendations to mitigate risk.
• Maintain security documentation, provide subject matter expertise, and collaborate on security policies, procedures, and standards.

Requirements

• Five (5) years or more experience with OWASP, SAST, DAST, SCA, RASP and common security tools, required.
• Seven (7) years or more application security, security engineering, software development, or a related field, required.
• Five (5) years or more strong understanding of web application security and common attack vectors (e.g. SQL injection, XSS, CSRF), required.
• Five (5) years or more experience with secure coding practices, threat modeling, and secure software development life cycle (SDLC) methodologies, required.
• Five (5) years or more proven experience in diagnosing, isolating, resolving complex issues and recommending/implementing strategies to resolve problems, required.
• Five (5) years or more demonstrated experience with systems integration processes, methodology and tools, required.
• Six (6) years or more experience process or operation management, required.
• Six (6) years or more experience Value Stream Mapping, Continuous Flow, Pull Replenishment and other process improvement experience, preferred.

Qualifications

• A Bachelor's degree in Computer Science and certifications such as CISSP, OSCP, or CASE are preferred.
• Excellent communication skills, both verbal and written, and the ability to work effectively with cross-functional teams.
• Ability to create and maintain professional relationships within all levels of the organization (peers, work groups, customers, supervisors).
• Ability to work independently and as a member of a team.
• Flexibility to operate and self-driven to excel in a fast-paced environment.
• Capable of multi-tasking, highly organized, with excellent time management skills.
• Proficiency in at least one programming language (e.g. Python, .NET, Javascript) with .NET preferred, advanced, required.
• Proficiency in at least one common scripting language (e.g. PowerShell, bash, etc.), advanced, required.
• Familiarity of NIST framework, PCI, ISO 27001, SOC, SOX, CCPA, GDPR and global regulations, expert, required.
• Risk management findings, vulnerability prioritization, threat modeling, and mitigation strategy, advanced, required.

Skills

• CISSP, OSCP, CASE, or other industry-leading certifications, preferred.

Benefits

• Comprehensive health and welfare benefits, to include medical, prescription, dental, vision, life insurance and disability insurance options, as well as paid time off for vacation, illness, bereavement, family and parental leave, and a tax-advantaged 401(k) retirement savings plan.

Pay

• Pay Type: Salaried
• Minimum Pay Range: $110,000.00
• Maximum Pay Range: $130,000.00

Schedule

• Not specified