Senior Information Security Engineer

Responsibilities

• Design and implement repeatable, scalable, and automated AppSec processes.
• Provide hands‑on technical leadership in tooling integration, automation, and process execution.
• Implement ongoing product (internal and vendor) enhancements and fine‑tune rules to increase precision in identifying and prioritizing application security defects.
• Manage upgrades, resiliency, continuity, and compliance with enterprise standards.
• Recommend mitigation strategies for identified application security risks.
• Serve as an AppSec representative in cross‑functional governance and technical forums.
• Support integration of AppSec controls across enterprise tools and CI/CD pipelines.
• Support reporting of AppSec processes, execution status, and outcomes.
• Collaborate with control management and cybersecurity leadership to design new security controls.
• Support internal and external audits, regulatory reviews, and third‑party assessments.
• Demonstrate proficiency in using AI‑assisted development and analysis tools (e.g., GitHub Copilot) and leverage AI to accelerate system design, coding, testing, analysis, and troubleshooting.
• Apply strong technical judgment when validating and integrating AI‑assisted outputs, understand model limitations, security risks, and operational considerations, and ensure AI usage aligns with security, compliance, privacy, and ethical standards.

Requirements

• 4+ years of Information Security Engineering experience, or equivalent demonstrated through work experience, training, military experience, or education.
• Expertise across core Application Security domains: SAST, DAST, SCA, secrets management and detection, Infrastructure as Code (IaC).
• Strong experience integrating SAST, DAST, and SCA tools into SDLC workflows and source code repositories.
• Advanced knowledge of GitHub, Jira, ServiceNow, Jenkins, Harness, and CI/CD ecosystems.
• Strong understanding of OWASP standards and MITRE CVE/CWE frameworks.
• Experience implementing and maturing Secure Software Development Lifecycle (SSDLC) practices across Agile and custom development frameworks.
• Familiarity with AI/LLM‑enabled development tooling (e.g., Cursor, GitHub Copilot, custom LLM integrations), including auto‑remediation capabilities using AI, and governance considerations.

Desired Qualifications

• 4+ years development experience in more than one programming language.
• 3+ years using IaC to configure, build, and deploy.
• 2+ years DevSecOps / automation experience.
• Hands‑on experience with vendor tools such as Checkmarx, Blackduck, Prisma, Trufflehog, Synk, Socket, Invicti, and Qualys.
• Proven experience with GitHub Advanced Security (GHAS), including secret scanning capabilities.
• Experience in API development and custom services.

Schedule

This position offers a hybrid work schedule and is not eligible for Visa sponsorship.

Pay

Salary ranges:

• $100,000 – $163,000 for Charlotte, NC; Chandler, AZ; Irving, TX; West Des Moines, IA; Columbus, OH; San Antonio, TX.
• $110,000 – $179,000 for Minneapolis, MN.

The base pay range may vary based on performance, skills, experience, or work location. Employees may also be eligible for incentive opportunities.

Benefits

• Health benefits
• 401(k) plan
• Paid time off
• Disability benefits
• Life, critical illness, and accident insurance
• Parental leave
• Critical caregiving leave
• Discounts and savings programs
• Commuter benefits
• Tuition reimbursement
• Scholarships for dependent children
• Adoption reimbursement