> Markdown version of [/jobs/ext/1989876-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/1989876-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Application Security Engineer

- **Company:** Actus Consulting Group, Inc.
- **Location:** Plano, TX, United States
- **Contract:** Permanent contract
- **Skills:** C (Programming Language), Java (Programming Language), Application Programming Interfaces (APIs), Amazon Web Services, Android Software Development, Apple IOS, Software System Penetration Testing, User Authentication, Authentication Protocols, Automation of Tests, Microsoft Azure, C++ (Programming Language), Cloud Computing, Cloud Computing Security, Cyber Security, Computer Engineering, Linux, Identity and Access Management, Systems Analysis, Internet Security, Mobile Application Software, Information Systems Security Architecture Professional, Python (Programming Language), Key Management, Network Security, Wireless Security, Network Segmentation, OAuth, Open Web Application Security, X.509, Software Tools, Cloud Services, Requirements Management, Reverse Engineering, Security Assertion Markup Language (SAML), Software Engineering, SSL Certificate Management, Data Logging, Scripting, Transport Layer Security, Cloud Platform System, Software Security, Test Scripts, Swift (Programming Language), Kotlin, Kubernetes, Information Technology, Wireless Technologies, Data Management, Api Gateway, Serverless Computing, Docker, Vulnerability Analysis, Programming Languages, Microservices
- **Published:** August 8, 2026
- **Apply:** https://www.careerbuilder.com/job-details/application-security-engineer-plano-texas-plano-tx--53517648-4f9a-4edf-ae47-da7dddb088d2

## About the Role

Bachelor's degree (or higher) in Computer Engineering, Computer Science, Cybersecurity or related is strongly desired
Strong understanding of OWASP Top 10, SANS Top 25, and common cloud & mobile application vulnerabilities
Hands-on experience securing cloud environments (AWS, Azure, or GCP), including identity and access management, network security groups, and cloud-native security tooling
Foundational knowledge in security assessment on OS or application-level of iOS/Android applications
Demonstrated ability to perform penetration testing against APIs, mobile applications (Android and iOS), and cloud infrastructure
Familiarity with programming languages such as C/C++, Java, Swift, Kotlin, and Python through practical experience
Familiarities with network security principles and various wireless security protocols
Knowledge of APIs security, application security, and authentication protocols such as OAuth, SAML, etc.
Basic knowledge and understanding of X.509, SSL/TLS certificate, and general certificate management process
Basic understanding of API security best practices
Willingness to learn developing security tools and automation scripts to support vulnerability assessment and penetration testing
Strong interest to acquire and develop additional skills such as Embedded systems security fundamentals, Demonstrates strong capability in conducting penetration testing and security assessments across applications, APIs, cloud environments, operating systems, and wireless technologies to identify, validate, and prioritize security risks
Applies deep knowledge of application, API, and cloud security principles-including authentication, authorization, and secure architectures, to assess real-world risk and recommend effective mitigations
Analyzes complex systems, reverse engineers software components, and develops proof-of-concept exploits to understand root causes, attack paths, and potential impact
Collaborates effectively with engineering and product teams to communicate findings, influence secure design decisions, and support remediation and re-validation efforts
Develops or enhances security testing tools, scripts, and automation to improve testing efficiency, consistency, and coverage
Continuously builds knowledge of emerging attack techniques, vulnerabilities, and security trends and applies learnings to improve security testing effectiveness

Skills:
Amazon Web Services (AWS), Android, Application Programming Interface (API), Applications Security, Architectural Analysis, Authentication, Best Practices, C Programming Language, C++ Programming Language, Cloud Applications, Cloud Computing, Communication Skills, Computer Engineering, Computer Science, Computer Security, Digital Certificates, Docker, Ecosystems, Embedded Systems, Engineering Software, Establish Priorities, GCP (Good Clinical Practices), Identity Data Management, Internet Security, Java, Kotlin, Linux Operating System, Machine Tool, Maintain Compliance, Microservices, Microsoft Windows Azure, Mobile Applications, Network Security, On Site Support, Operating Systems, Penetration Testing, Product Testing, Programming Languages, Python Programming/Scripting Language, Regulatory Compliance, Requirements Management, Requirements Validation/Verification, Reverse Engineering, Risk, SSL-TLS (Secure Socket Layer - Transport Layer Security), Scripting (Scripting Languages),
Security Analysis, Security Compliance, Security Protocols, Software Engineering, Systems Analysis, Test Automation, Test Scripts, Test Tools, Testing, Willing to Travel, Wireless Communications, Wireless Protocols/Standards, Wireless Security, X.509 Digital Certificate, iOS

## Description

This role is responsible for performing advanced product security testing to strengthen the cybersecurity posture across next-generation vehicle and connected services platforms. As part of the Product Security Testing Team (PSTT) within the Product Cybersecurity Group (PCG), the position conducts hands-on security assessments, penetration testing, and vulnerability research across APIs, mobile applications (iOS and Android), cloud-hosted services, Linux systems, and wireless technologies. Responsibilities include validating security requirements against implementation, developing proof-of-concept exploits, reverse engineering software components, and clearly communicating security risks and remediation guidance to engineering teams. This role requires strong technical depth, an offensive security mindset, and close collaboration with cross-functional stakeholders., Conduct analysis of security requirements specifications against implementation
Perform security assessments and penetration testing including but not limited to mobile applications (iOS and Android), wireless security, APIs, cloud environments, and Linux OS
Evaluate cloud infrastructure security across AWS, Azure, or GCP environments, including IAM policies, network segmentation, storage configurations, and serverless architectures
Assess container and orchestration security (Docker, Kubernetes) for vehicle-connected cloud services and microservices deployments
Review cloud-native application security controls such as API gateways, service meshes, secrets management, and logging/monitoring configurations
Communicate complex technical findings and recommend the appropriate course of action, supporting the mitigation and re-validation efforts
Support testing Connected Services ecosystems to identify and report security vulnerabilities and ensure compliance with security standards
Develop and maintain security testing tools to support penetration testing and security verification activities, ensuring thorough identification of vulnerabilities
Develop skills through continuous learning and apply what you have learned relevant to emerging attack vectors, vulnerabilities, and exploits across application and cloud domains
Travel to clients or partners sites as needed to provide on-site support for security testing and verification activities


## Related Videos

- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [Keeping applications secure by evolving OAuth 2.0 and OpenID Connect](https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect)
- [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker)
- [Software Security 101: Secure Coding Basics](https://www.wearedevelopers.com/videos/220-software-security-101-secure-coding-basics)
- [Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue](https://www.wearedevelopers.com/videos/1637-delay-the-ai-overlords-how-oauth-and-openfga-can-keep-your-ai-agents-from-going-rogue)
- [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker)

## Related Articles

- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [The 8 Best Code Testing Tools](https://www.wearedevelopers.com/magazine/402-the-8-best-code-testing-tools)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers)