> Markdown version of [/jobs/ext/2000239-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/2000239-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Application Security Engineer

- **Company:** Pinnacle Bank
- **Location:** Tysons, VA, United States
- **Experience:** Experienced
- **Salary:** $115,000.0
- **Contract:** Permanent contract
- **Skills:** Java (Programming Language), Application Programming Interfaces (APIs), Amazon Web Services, Applications Architecture, Business Logic, User Authentication, Authentication Protocols, Microsoft Azure, Burp Suite, Cloud Computing, Cyber Security, Computer Networks, Continuous Integration, Desktop Computing, Github, Monitoring of Systems, Key Management, PostgreSQL, OAuth, Ansible, JSON Web Token, Web Application Security, Software Engineering, SQL Databases, Data Streaming, Systems Integration, Tripwire, Web Applications, Workflow Management Systems, Okta, Spring-boot, Software Security, Backend, Gitlab, Containerization, AngularJS, Gitlab-ci, Kubernetes, Information Technology, Tenable Nessus, Front End Software Development, Restful APIs, Devsecops, Static Application Security Testing, Web Api, Dynamic Application Security Testing
- **Published:** August 9, 2026
- **Apply:** https://www.wayup.com/i-j-Application-Security-Engineer-Veilant-941218133754790/

## About the Role

+ Ability to obtain a Security Clearance
 + 2+ years of software development experience in Java.
 + Hands-on experience reviewing or securing applications built with Java Spring Boot, Angular, REST APIs, SQL databases, and PostgreSQL.
 + Working knowledge of authentication and authorization technologies, including JWT, OAuth, identity providers, Entra, Keycloak, and token-based access models.
 + Experience intercepting, decrypting, manipulating, and analyzing web or application network traffic.
 + Demonstrated ability to find, validate, and explain vulnerabilities in a real codebase.
 + Familiarity with CI/CD tools such as GitLab CI, Azure DevOps, or GitHub Actions.
 + Experience with containerized environments and orchestration tools such as Kubernetes.
 + Exposure to infrastructure-as-code and container scanning tools such as Trivy, Kubesec, or similar technologies.
 + Understanding of cloud hosting environments such as Azure or AWS.
 + Familiarity with secrets management tools such as GitLab Secrets Manager, AWS KMS, Azure Key Vault, or Ansible Vault.
 + Experience with automated application security testing, including SAST, DAST, and SCA.
 + Familiarity with runtime security and monitoring tools for containers, such as Falco, NeuVector, or similar platforms.
 + Hands-on web security testing experience using Burp Suite or comparable tooling.
 + Strong written communication skills, including the ability to write reports for both technical and non-technical audiences.
 + OSWE, OSCP, and/or GXPN certifications are highly desirable.
The Kind of Person Who Will Thrive Here
You will do well in this role if you are curious, collaborative, and comfortable working across both code and security. You know how to speak with developers in practical terms, explain risk without creating unnecessary friction, and help teams ship secure software without slowing the mission down.
You are someone who can move from reviewing source code, to analyzing an API request, to modeling a threat scenario, to writing a report that an executive can understand. You enjoy solving problems at the root cause, not just documenting symptoms., + Must be able to remain in a stationary position 50% of the time. The person in this position needs to occasionally move about inside the office

 + Constantly work with computers and other information technology equipment
 + The ability to communicate information and ideas in a classroom style format, may stand at a podium for long periods of time

## Description

Veilant is looking for an Application Security Engineer to join our InfoSec team and help validate, secure, and continuously improve software developed by internal and partner engineering teams.
This role is ideal for someone who combines a software engineering foundation with an attacker mindset. You will review major and minor software releases before deployment, identify and validate vulnerabilities, create proof-of-concept demonstrations where appropriate, and provide practical remediation guidance that developers can act on.
You will not simply file security tickets and move on. You will work closely with engineering teams to understand application architecture, business logic, user workflows, data sensitivity, and production environments so that your findings are accurate, contextualized, and useful.
You will work collaboratively across Veilant's software, DevSecOps, and infrastructure teams.
In this role, you will:

 + Audit software releases across major and minor cycles to intercept and remediate security flaws before deployment.
 + Analyze source code to identify, isolate, validate, and contextualize vulnerabilities in complex application codebases.
 + Build safe proof-of-concept examples to demonstrate exploitation paths and verify the real-world impact of discovered risks.
 + Contextualize findings based on application business logic, user workflows, data sensitivity, and production use cases.
 + Author clear remediation guidance and partner with development teams to implement effective patches, controls, or architectural mitigations.
 + Intercept and analyze application-layer network traffic using tools such as Burp Suite or similar intercepting proxies to inspect encrypted payloads, API calls, and authentication flows.
 + Assess and help secure core architectures across REST APIs, SQL databases, PostgreSQL, JWT/OAuth, identity providers, and token-based authentication mechanisms.
 + Perform threat modeling for web applications based on use cases, data flows, user roles, trust boundaries, and production environments.
 + Improve DevSecOps pipelines by integrating, tuning, and operationalizing SAST, DAST, SCA, IaC scanning, secrets detection, and container security tooling.
 + Support container runtime security efforts using monitoring and runtime protection tools such as Falco, NeuVector, or similar technologies.
 + Create standardized security reporting that translates technical findings into clear risk narratives for both engineering teams and executive stakeholders.
What You Will Accomplish in Your First Six Months
Within your first six months, success in this role will look like:
Building a repeatable AppSec review process for major and minor software releases, helping engineering teams identify and resolve security issues before deployment.
Integrating and improving SAST, DAST, and SCA checks in CI/CD pipelines so that security testing becomes a reliable part of the development lifecycle rather than a late-stage blocker.
Establishing threat modeling practices for web applications using common frameworks and applying them to Veilant's Angular front-end, Java Spring Boot back-end, REST APIs, SQL databases, and authentication flows.
Partnering with engineering and software teams to improve secure coding practices through practical feedback, remediation guidance, and collaborative reviews.
Implementing best practices in container runtime security , including visibility, monitoring, and runtime protections for containerized workloads.
Writing standardized security reports that clearly communicate risk, impact, and remediation steps for both executive-level stakeholders and engineering teams.


## Related Videos

- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [Keeping applications secure by evolving OAuth 2.0 and OpenID Connect](https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect)
- [Innovating Developer Tools with AI: Insights from GitHub Next](https://www.wearedevelopers.com/videos/1268-innovating-developer-tools-with-ai-insights-from-github-next)
- [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see)
- [Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue](https://www.wearedevelopers.com/videos/1637-delay-the-ai-overlords-how-oauth-and-openfga-can-keep-your-ai-agents-from-going-rogue)
- [Bringing AI Model Testing and Prompt Management to Your Codebase with GitHub Models](https://www.wearedevelopers.com/videos/1536-bringing-ai-model-testing-and-prompt-management-to-your-codebase-with-github-models)

## Related Articles

- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [The 12 Best Jobs for Software Engineers](https://www.wearedevelopers.com/magazine/401-the-12-best-jobs-for-software-engineers)
- [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)
- [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)