> Markdown version of [/jobs/ext/2065574-senior-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/2065574-senior-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Application Security Engineer - **Company:** World Wide Technology - **Location:** United States (Remote available) - **Experience:** Expert - **Salary:** $116,000.0 - $145,000.0 - **Contract:** Permanent contract - **Skills:** Java (Programming Language), JavaScript (Programming Language), Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Software System Penetration Testing, Architectural Patterns, Microsoft Azure, Bash Shell, C Sharp (Programming Language), Cloud Engineering, Cyber Security, Continuous Integration, DevOps, Github, Python (Programming Language), Key Management, OAuth, OpenID, OpenShift, Open Web Application Security, Public Key Infrastructure, Windows PowerShell, Systems Development Life Cycle, JSON Web Token, Secure Coding, Session Management, Software Engineering, Data Streaming, Systems Integration, TypeScript, Software Vulnerability Management, Google Cloud, Large Language Models, Software Security, Mitre Att&ck, Veracode, HybridCloud, GWAPT, Gitlab-ci, Kubernetes, Information Technology, Graphql, Checkmarx, Virtual Agents, Docker, Jenkins, Static Application Security Testing, Web Api, Golang, Dynamic Application Security Testing - **Published:** August 15, 2026 - **Apply:** https://www.jobmonkeyjobs.com/career/27938265/Senior-Application-Security-Engineer-Any-Remote-Nationwide-7449 ## About the Role * Bachelor's degree in Computer Science, Software Engineering, Information Security, or a related field - or equivalent hands-on experience. * Minimum 8 years of experience in roles related to application security, information security, software engineering, SecDevOps. * A demonstrable track record of independently owning AppSec domains and delivering remediation without close supervision. * Hands-on experience operating application security scanning tooling (SAST, SCA, secrets, IaC) and integrating it into CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins, Azure DevOps, or equivalent). * Experience securing cloud-native and container/Kubernetes-based applications (AWS, Azure, GCP; Docker, Kubernetes, OpenShift). * Ability to read and reason about code in one or more modern stacks (Java, JavaScript/TypeScript, Python, Go, or C#) well enough to perform and review secure code, trace data flows, and identify vulnerabilities in source code. * Scripting and automation in Python, Bash, or PowerShell. * Design-level understanding of authentication, authorization, and identity - session management, SSO and federation, and OAuth2/OIDC as architectural patterns. * Working knowledge of applied cryptography - TLS, certificates and PKI, secrets and key management, hashing versus encryption. * Strong command of HTTP and web API internals - request/response semantics, auth flows (OAuth2/OIDC, JWT, session management), and the authZ failures, injection, and business-logic flaws common to REST and GraphQL APIs. * Solid understanding of the secure software development lifecycle and where security testing, gates, and controls fit within it. * Strong working knowledge of OWASP ASVS, OWASP Top 10, OWASP API Security Top 10, MITRE ATT&CK, and CWE. * Working knowledge of NIST SSDF (SP 800-218), NIST 800-53, NIST 800-171, ISO 27001, SOC 2, and CMMC as they apply to secure software development. * Hands-on threat modeling experience (STRIDE, PASTA, or equivalent). * Excellent interpersonal, written, and verbal communication - able to explain and document security risk and remediation credibly to both engineers and non-technical stakeholders. * Self-starter, team player, and enthusiasm for learning. * Applicants must be authorized to work in the United States without sponsorship. We are unable to provide sponsorship now or in the future for this position., * Direct, hands-on experience with one or more leading application security platforms (e.g., Wiz, Snyk, Apiiro, OX Security, Cycode, Checkmarx, Veracode, or GitHub Advanced Security). * Hands-on experience securing AI/LLM-enabled and agentic applications; familiarity with OWASP Top 10 for LLM Applications, OWASP Top 10 for Agentic AI, MITRE ATLAS, NIST AI RMF, and Model Context Protocol (MCP) security implications. * Hands-on penetration testing or offensive security experience across web, API, infrastructure, or AI systems (including prompt injection, jailbreaks, and agent abuse). * Industry certifications such as CISSP, CSSLP, GWAPT, GWEB, OSCP, OSWE, or AWS/Azure/GCP security certifications. ## Description World Wide Technology's Information Security organization is hiring a Senior Application Security Engineer to help secure the organization's application ecosystem and reduce risk across WWT-developed and WWT-operated software. As a Senior Application Security Engineer, you'll be a hands-on technical contributor helping mature an evolving application security function. Your focus is executing the highest-impact technical security work and enabling developers to ship secure code at speed through threat modeling, secure code review, security tooling and automation, and vulnerability remediation. Operating across containerized, hybrid-cloud environments, you'll partner closely with engineering, DevOps, and compliance and risk management teams to embed security into the SDLC. You'll help grow the skills of those around you and act as a trusted application security resource for development and other teams across the organization. This is a role for an engineer who wants to help shape the practices that keep our applications secure. Key Responsibilities Application Vulnerability & Risk Management * Own the technical core of the application vulnerability lifecycle, driving discovery and detection, validating exploitability, prioritizing by risk, offering technical remediation guidance, and verifying fixes fully close the issue. * Cut through scanner noise by dismissing false positives with rationale and documenting clear, actionable remediation developers can act on. * Maintain playbooks that make triage, escalation, and remediation repeatable as we scale. Application Security Tooling * Operate and maintain application security tooling (SCA, SAST, DAST, secrets, etc.) across the SDLC. * Drive adoption of security tooling, partnering with developers to integrate into their workflows and maximize meaningful coverage. Secure SDLC & Developer Enablement * Partner with DevOps to build security into delivery by integrating SCA, SAST, and DAST into the CI/CD pipeline. * Perform secure code reviews, threat models (STRIDE/PASTA), and design and architecture reviews for net-new and high-risk applications. * Surface validated findings where developers already work - IDE, pull request, ticketing - to minimize noise and context switching. * Contribute to documentation that gives developers a clear path to shipping secure code. Penetration Testing * Scope, execute, and coordinate penetration tests across the organization's environment overseeing remediation and validation retests. * Perform hands-on manual testing to uncover business-logic flaws, chained exploits, and vulnerabilities that automated scanners miss. Secure AI / LLM Application Security * Apply secure development practices to AI/LLM-enabled and agentic applications; assess risks like prompt injection, tool poisoning, confused-deputy, and credential exposure. * Make responsible, hands-on use of AI to work faster and more effectively, reflecting our culture as an AI-first company operating at the leading edge of the field. Collaboration & Mentorship * Act as a credible application security escalation point for engineering and a force multiplier - an enabler, not a gatekeeper. * Produce technical evidence and control mappings that satisfy compliance and audit needs across CMMC, SOC 2, ISO 27001, and NIST 800-171/800-53. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Keeping applications secure by evolving OAuth 2.0 and OpenID Connect](https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect) - [Go with the Flow: Stop the Leaks Before Your Memory's a Waterfall!](https://www.wearedevelopers.com/videos/100073-go-with-the-flow-stop-the-leaks-before-your-memory-s-a-waterfall) - [Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue](https://www.wearedevelopers.com/videos/1637-delay-the-ai-overlords-how-oauth-and-openfga-can-keep-your-ai-agents-from-going-rogue) - [Scoring 2000 Products per Request: Performance Pitfalls in Golang](https://www.wearedevelopers.com/videos/2073-scoring-2000-products-per-request-performance-pitfalls-in-golang) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) ## Related Articles - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)