> Markdown version of [/jobs/ext/2195998-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/2195998-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Application Security Engineer - **Company:** Justice and Public Safety Cabinet of Kentucky - **Location:** United States (Remote available) - **Experience:** Expert - **Salary:** $112,130.0 - $140,171.0 - **Contract:** Permanent contract - **Skills:** Java (Programming Language), Amazon Web Services, Software System Penetration Testing, Microsoft Azure, Biometrics, Cloud Computing Security, Continuous Integration, Identity and Access Management, Key Management, Cisco Nexus Switches, Software Engineering, SonarQube, TypeScript, Cloud Platform System, Delivery Pipeline, Software Security, AWS Lambda, GWAPT, Gitlab-ci, Devsecops, Jenkins, Static Application Security Testing - **Published:** August 23, 2026 - **Apply:** https://www.dice.com/job-detail/6e0620e7-c711-48ba-9d4f-817aa12a1a51 ## About the Role We are seeking a Senior Application Security Engineer to define and own our holistic approach to application security across the full software development lifecycle. You will establish the security controls that govern our engineering practices, guide multiple teams across three product lines in their implementation, and remain directly involved in hands-on execution. This is a senior individual contributor position with significant organizational influence and no direct reports., * Minimum 10 years of combined software engineering and security experience, including substantive time in a DevSecOps capacity * Demonstrated experience embedding security controls directly into CI/CD pipelines * Proven ability to conduct security reviews of application and cloud architectures * Practical experience triaging SAST, SCA, and penetration test findings, including distinguishing material risk from false positives * Working knowledge of cloud security in AWS and/or Azure, preferably government cloud environments * Familiarity with FedRAMP, CJIS, NIST 800-53, or comparable frameworks * Ability to obtain and maintain background clearances from local, state, and federal agencies * Availability to travel approximately 10% of the time, * Certifications such as CISSP, CSSLP, GWAPT, or OSCP * Experience in biometrics, identity management, or public safety software * Threat modeling experience (STRIDE, PASTA, or comparable) * Secrets management and software supply chain security, including SBOM generation ## Description IDEMIA's Justice & Public Safety division develops biometric identification platforms used by law enforcement agencies across North America. Our systems process fingerprint, facial recognition, and criminal history data in support of active investigations, which requires that security be embedded throughout our engineering practices rather than addressed at the end of the development cycle., Define and own the holistic approach to security * Establish security controls and validation gates for each lifecycle stage: design, code, build, deploy, software customization and delivery, and operations * Develop the standards, guardrails, and documentation guiding multiple engineering teams across three product lines * Partner with our internal shared security services team, which conducts penetration testing and SAST/SCA scanning, to triage findings, assess severity, and set remediation priorities Execute hands-on security work * Conduct architecture and design reviews to identify security risk, and collaborate with engineering teams on remediation * Develop and enhance security stages within our CI/CD pipelines * Participate in incident response and triage activities Support compliance and customer engagement * Maintain our FedRAMP and CJIS compliance posture as it pertains to application security * Represent our security approach in customer engagements, audits, and technical reviews Technical Environment Languages and runtimes: Java, TypeScript, AWS Lambda * Cloud platforms: AWS GovCloud, Azure Government * CI/CD: GitLab CI, AWS CodePipeline, Jenkins * Security tooling: SonarQube, Nexus, Tenable Performance Expectations * First 90 days - Document the current lifecycle and tooling landscape, publish a defined set of security controls organized by lifecycle stage, establish a triage cadence with the shared security services team, and deliver at least one measurable improvement to pipeline security posture. * First year - Security controls applied consistently across all product lines, findings remediated on a predictable schedule, and engineering teams engaging security during design rather than at review. Scope of Authority Where a release does not meet established security criteria, you will raise the concern and escalate to the Vice President of Engineering for final determination. Your technical judgment will drive these discussions, supported by executive sponsorship. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [DevSecOps: Injecting Security into Mobile CI/CD Pipelines](https://www.wearedevelopers.com/videos/273-devsecops-injecting-security-into-mobile-ci-cd-pipelines) - [The Road to MLOps: How Verivox Transitioned to AWS](https://www.wearedevelopers.com/videos/1050-the-road-to-mlops-how-verivox-transitioned-to-aws) - [DevSecOps: Security in DevOps](https://www.wearedevelopers.com/videos/36-devsecops-security-in-devops) - [DevSecOps culture](https://www.wearedevelopers.com/videos/783-devsecops-culture) - [Enterprise-Cloud-Native - Fast-Paced Development & Deployment in a Highly Secure Banking Environment](https://www.wearedevelopers.com/videos/671-enterprise-cloud-native-fast-paced-development-deployment-in-a-highly-secure-banking-environment) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs) - [The 12 Best Jobs for Software Engineers](https://www.wearedevelopers.com/magazine/401-the-12-best-jobs-for-software-engineers) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)