Senior Information Security Engineer

Responsibilities

• Design and implement repeatable, scalable, and automated Application Security (AppSec) processes.
• Provide hands‑on technical leadership in tooling integration, automation, and process execution.
• Implement ongoing product (internal and vendor) enhancements and fine‑tune rules to increase precision in identifying and prioritizing application security defects.
• Manage upgrades, resiliency, continuity, and compliance with enterprise standards.
• Recommend mitigation strategies for identified application security risks.
• Serve as an AppSec representative in cross‑functional governance and technical forums.
• Support integration of AppSec controls across enterprise tools and CI/CD pipelines.
• Support reporting of AppSec processes, execution status, and outcomes.
• Collaborate with control management and cybersecurity leadership to design new security controls.
• Support internal and external audits, regulatory reviews, and third‑party assessments.
• Demonstrate proficiency in using AI‑assisted development and analysis tools (e.g., GitHub Copilot and approved code‑centric agents) and apply strong technical judgment when validating and integrating AI‑assisted outputs.
• Leverage AI to accelerate system design, coding, testing, analysis, and troubleshooting while ensuring alignment with security, compliance, privacy, and ethical standards.

Requirements

Required Qualifications:

• 4+ years of Information Security Engineering experience, or equivalent demonstrated through work experience, training, military experience, or education.
• Expertise across core Application Security domains: SAST, DAST, SCA, secrets management and detection, Infrastructure as Code (IaC).
• Strong experience integrating SAST, DAST, and SCA tools into SDLC workflows and source code repositories.
• Advanced knowledge of GitHub, Jira, ServiceNow, Jenkins, Harness, and CI/CD ecosystems.
• Strong understanding of OWASP standards and MITRE CVE/CWE frameworks.
• Experience implementing and maturing Secure Software Development Lifecycle (SSDLC) practices across Agile and custom development frameworks.
• Familiarity with AI/LLM‑enabled development tooling (e.g., Cursor, GitHub Copilot, custom LLM integrations), including auto‑remediation capabilities and governance considerations.

Desired Qualifications:

• 4+ years of development experience in more than one programming language.
• 3+ years using IaC to configure, build, and deploy.
• 2+ years of DevSecOps / automation experience.
• Hands‑on experience with vendor tools such as Checkmarx, Blackduck, Prisma, Trufflehog, Synk, Socket, Invicti, Qualys.
• Proven experience with GitHub Advanced Security (GHAS), including secret scanning capabilities.
• Experience in API development and custom services.

Skills

• Static Application Security Testing (SAST)
• Dynamic Application Security Testing (DAST)
• Software Composition Analysis (SCA)
• Secrets management and detection
• Infrastructure as Code (IaC)
• GitHub, GitHub Advanced Security, GitHub Copilot
• Jira, ServiceNow
• Jenkins, Harness, CI/CD pipelines
• OWASP standards
• MITRE CVE/CWE frameworks
• Secure Software Development Lifecycle (SSDLC)
• AI/LLM‑enabled development tools and governance
• Vendor security tools (Checkmarx, Blackduck, Prisma, Trufflehog, Synk, Socket, Invicti, Qualys)
• API development

Benefits

• Health benefits
• 401(k) plan
• Paid time off
• Disability benefits
• Life, critical illness, and accident insurance
• Parental leave
• Critical caregiving leave
• Discounts and savings programs
• Commuter benefits
• Tuition reimbursement
• Scholarships for dependent children
• Adoption reimbursement

Pay

Base pay range: $100,000 – $179,000, varying by location (e.g., Charlotte, NC; Chandler, AZ; Irving, TX; West Des Moines, IA; Columbus, OH; San Antonio, TX; Minneapolis, MN). Pay may vary based on performance, skills, experience, or work location. Employees may also be eligible for incentive opportunities.

Schedule

• Hybrid work schedule.
• Position is not eligible for Visa sponsorship.