> Markdown version of [/jobs/ext/1438953-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/1438953-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Application Security Engineer - **Company:** Wawa Inc. - **Location:** United States - **Experience:** Experienced - **Contract:** Permanent contract - **Skills:** Kubernetes Security, Java (Programming Language), JavaScript (Programming Language), Software System Penetration Testing, Application Testing, Cloud Computing, Cyber Security, Computer Programming, Custom Software, Data Security, Information Security Management, Information Systems Security Architecture Professional, Python (Programming Language), Unix Shell, Open Web Application Security, Windows PowerShell, Systems Development Life Cycle, Secure Coding, Software Engineering, TCP/IP, TypeScript, Software Vulnerability Management, Enterprise Software Applications, IT General Controls (ITGC), ReactJS, Software Security, Virtual Environment, Information Technology, React Native, Devsecops, Static Application Security Testing, Vulnerability Analysis, Golang, Dynamic Application Security Testing - **Published:** July 25, 2026 - **Apply:** https://www.juju.com/job/00000000gjdbbu ## About the Role + Ability to maintain and exude a positive attitude by committing to new ideas, being enthusiastic about work, and being helpful to, and thoughtful and considerate of, others across the organization. + Proven experience securing custom software. + Ability to work well individually and in a team environment. + Ability to learn on the job. + Ability to track task progress effectively. + Experience working with teams of developers and product owners. + Excellent written and verbal communication skills, interpersonal and collaborative skills, and the ability to communicate application security and risk-related concepts to diverse audiences. + Poise and ability to act calmly and competently in high-pressure, high-stress situations. + Must be a critical thinker, with strong problem-solving skills. + Ability to manage multiple projects under strict timelines, as well as the ability to work well in a demanding, dynamic environment and meet overall objectives. + Ability to engage in internal security technology projects and security remediation projects. + Ability to understand large technology implementations spanning hundreds of physical and virtual environments. + High level of personal integrity, as well as the ability to professionally handle confidential matters and show an appropriate level of judgment and maturity. + High degree of initiative, dependability, and ability to work with little supervision while being resilient to change. + Ability to be on-call 24x7x365 rotation for information security incidents. Basic Requirements: + Minimum of 2 years of experience in a complex technology environment, working in the application security engineering field. + Advanced knowledge of containers and container security. + Solid knowledge of cloud technology and security. + Solid knowledge of Java programming. + Basic knowledge of Golang programming. + Basic knowledge of React and React Native programming. + Experience with reading and writing enterprise software. + Experience preventing and remediating software security flaws in enterprise software. + Up-to-date knowledge of common security weaknesses and flaws, and how to prevent and remediate them. + Advanced knowledge of OWASP guidance. + Solid knowledge of web-related protocols (TCP/IP, HTTP, HTTPS, REST, etc.). + Understanding of relevant legal and regulatory requirements, such as Payment Card Industry Data Security Standard. + Degree in computer science preferred, or equivalent professional experience. + Professional security management certification is preferred, such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), GIAC Defensible Security Certification (GDSA), Certified Secure Software Lifecycle Professional (CSSLP), Certified Ethical Hacker (CEH), etc. + Solid knowledge of common information security management frameworks, such as Critical Security Controls, and NIST 800-53 and Cybersecurity Framework. + Significant knowledge of application security concepts and technologies such as: SAST, DAST, SCA, IaC, cryptography, authn/authz, API security, etc. + Strong understanding of cloud, application security, and software engineering principles. + Experience with scripting automation (Python, PowerShell, Unix shell, JavaScript, TypeScript etc.). + Proven experience and strong understanding of the DevSecOps and SAFE Agile working methodologies. ## Description **Job Summary:** The Application Security Engineer is responsible for operating, supporting, maintaining, and improving the application security program by helping to ensure that security is built into all internally developed applications. This role executes all day-to-day operations, maintenance, functions, and capabilities relating to application security. Assist with the build and operation of application security tooling, automation, and engage with developers and product owners to solve application security problems. The role serves as a technical resource in the areas of secure software development at all stages of the SDLC and general information security best practices across all technology domains. The engineer is responsible for operating and improving Wawa's application security processes to secure and maintain Wawa's technology. Principal Duties: _Operate and Support the Application Security Program_ + Support security best practices in the software development lifecycle by way of working closely with developers and product owners to secure applications at all stages. + Research, identify and communicate current and emerging application security threats and solutions. + Maintain, and iterate on secure coding practices, policies, standards, and procedures. + Test applications against security threats and vulnerabilities. + Support application security vulnerability management. + Create and deliver security presentations to technical and non-technical internal audiences. + Identify security design gaps in existing and proposed applications and recommend changes or enhancements. + Identify gaps and inefficiencies in the Application Security Program on a continual basis and propose solutions. + Participate in and support application security reviews, penetration tests, and threat modeling. + Contribute to the direction of internal security-focused programs. _Provide Strategic Support_ + Assist in the development of metrics and reporting framework to measure the effectiveness of the program. + Support the development and maintenance of Wawa's technology security policies and standards and ensure their application to technology architectures. + Assist with ensuring the ongoing compliance with both regulatory obligations and internally developed policies and standards. + Provide support to Technology Security Incident Response team during cyber incidents. _Serve as Security Liaison_ + Maintain internal networks among information security, information technology, and development teams to ensure support and alignment on initiatives. + Maintain external networks consisting of industry peers, ecosystem partners, vendors, and other relevant parties to address common trends, findings, and cybersecurity risks. + Act as technical resource for internal business teams and the IT department to plan, implement, and support new and existing software. + Support audit and assessment process for IT including annual PCI audit, IT general controls review, and any other audits or assessments of security and general IT controls. + Provide application security guidance on IT and business-related projects as required by the business. Participate in IT and security related projects. + Work effectively with business units to facilitate applications security engineering requirements and advocate application security best practices. ## Related Videos - [Watch Tests Go Brrrr! : Getting Started with Cypress in ReactJS](https://www.wearedevelopers.com/videos/282-watch-tests-go-brrrr-getting-started-with-cypress-in-reactjs) - [An Applied Introduction to eBPF with Go](https://www.wearedevelopers.com/videos/1075-an-applied-introduction-to-ebpf-with-go) - [Go with the Flow: Stop the Leaks Before Your Memory's a Waterfall!](https://www.wearedevelopers.com/videos/100073-go-with-the-flow-stop-the-leaks-before-your-memory-s-a-waterfall) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Turning Container security up to 11 with Capabilities](https://www.wearedevelopers.com/videos/718-turning-container-security-up-to-11-with-capabilities) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) ## Related Articles - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [7 Important Tips That Every Software Developer Should Know](https://www.wearedevelopers.com/magazine/101-7-important-tips-that-every-software-developer-should-know) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Now is the time for industrialized software development](https://www.wearedevelopers.com/magazine/601-now-is-the-time-for-industrialized-software-development)