> Markdown version of [/jobs/ext/2553616-principal-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/2553616-principal-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Principal Application Security Engineer

- **Company:** CDW
- **Location:** United States
- **Experience:** Expert
- **Salary:** $172,000.0 - $240,000.0
- **Contract:** Permanent contract
- **Skills:** Kubernetes Security, Java (Programming Language), JavaScript (Programming Language), Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Microsoft Azure, C Sharp (Programming Language), Cloud Engineering, Encodings, Continuous Integration, Software Design Patterns, DevOps, Distributed Systems, Information Security Management, Intrusion Detection and Prevention, Python (Programming Language), Key Management, Open Web Application Security, Reliability Engineering, Akamai, Zero Trust Network Access, Secure Coding, Session Management, Software Engineering, TypeScript, Policy as Code, Delivery Pipeline, Large Language Models, Software Security, Terraform, Service Stack, Static Application Security Testing, Vulnerability Analysis, Dynamic Application Security Testing
- **Published:** August 22, 2026
- **Apply:** https://diversityjobs.com/main/sendform/8/8/28176/1/18040477?backUrl=%2Fcareer%2F18040477%2FPrincipal-Application-Security-Engineer

## About the Role

* 10+ years of experience in Application Security Engineering, including hands-on work embedding security into software design, development, and delivery practices.

 * Deep, hands-on expertise in secure application architecture and design, secure coding practices, code-level vulnerability analysis, and threat modeling.

 * Background in software engineering, application development, or architecture, with the ability to engage credibly at the design, code, build, or runtime levels.

 * Strong command of authentication, authorization, session management, API security, secrets management, and common application vulnerabilities and exploit patterns, including OWASP Top 10 classes, injection, deserialization, SSRF, insecure design, access control issues, and dependency risk.

 * Hands-on experience securing applications built in one or more modern technology stacks such as C#, Java, Python, JavaScript or TypeScript, Go, or similar.

 * Strong experience integrating security into CI/CD pipelines, developer workflows, and engineering platforms, including technologies such as SAST, SCA, DAST, IaC scanning, container security, API security testing, and software supply chain security controls.

 * Ability to independently investigate complex technical problems, identify root causes, and drive practical remediation while moving fluidly between enterprise patterns and code-level detail.

 * Strong written and verbal communication skills with the ability to influence engineers, platform teams, and senior stakeholders through technical credibility, sound judgment, and partnership.

 * Strong sense of ownership and accountability, with the ability to balance hands-on technical execution with mentoring others, raising standards, and driving organization-wide improvements in application security.

 * Experience defining standards, playbooks, secure reference architectures, or scalable practices that can be adopted broadly across engineering organizations.

 * Experience with software supply chain security, including dependency risk management, build pipeline hardening, SBOM, artifact integrity, provenance, and package governance, a plus.

 * Hands-on experience with AI security, including securing AI-enabled applications or advising engineering teams on the secure use of AI or LLM-based capabilities, a plus.

 * Familiarity with Zero Trust, secure platform engineering, and policy-as-code approaches, a plus.

 * Prior experience serving as an Application Security Champion, Security Champion, embedded security lead, principal engineer, or senior engineer responsible for driving security within product or application teams, a plus.

 * Experience with runtime application protection, exploit prevention, threat detection technologies, and abuse case analysis, a plus.

 * Experience influencing secure development practices across decentralized or federated engineering organizations, including driving adoption through partnership, standards, and enablement, a plus.

 * Experience defining and using application security metrics, maturity measures, or risk-based reporting to prioritize improvements and demonstrate impact, a plus.

 * Experience designing security controls for cloud-native and distributed systems running in Azure, AWS, or GCP, a plus.

 * Experience designing, deploying, or tuning Akamai protections, a plus.

 * Experience with reviewing and securing IaC (Terraform or similar), a plus., We're looking for people who bring curiosity, a learner's mindset, and a willingness to engage with ever-evolving technology and tools. We value adopting AI as a partner, openness to experimentation, and a shared interest in learning together on AI. Our goal is to create a culture where AI enhances-not replaces-human creativity and decision-making. You don't need to be an expert today; what matters is your readiness to explore, adapt, and grow with us as we integrate AI responsibly and effectively into our work.

## Description

Join CDW and help secure the software, platforms, and services that support more than 250,000 customers across enterprise, government, education, and healthcare. As part of CDW's Global Information Security team, you will help shape how application security is embedded into engineering at scale-partnering across development, platform engineering, SRE, and DevOps to reduce risk while enabling delivery.

As a Principal Application Security Engineer, you will serve as a senior technical leader and trusted advisor who helps influence secure engineering practices across the enterprise. You will bring deep hands-on application security expertise while enabling teams to adopt scalable patterns, controls, and guardrails across applications, APIs, and software delivery pipelines. This role is ideal for someone who can move fluidly between strategy and execution-shaping direction, building trust through influence, and diving into technical detail when needed.

What you will do

 * Lead high-impact secure code reviews, threat models, and secure design assessments for applications, APIs, and shared services-translating technical risk into clear guidance for engineers, technical leaders, and business stakeholders.

 * Drive the design, integration, and continuous improvement of application security controls across CI/CD platforms, workflows, and environments in close partnership with engineering, DevOps, and platform teams.

 * Identify control gaps, coverage weaknesses, and sources of engineering friction across the software delivery lifecycle, and drive practical remediation through automation, platform improvements, and secure-by-design patterns.

 * Define, advocate for, and build secure coding standards, reference architectures, playbooks, tooling, and automations that scale application security without slowing delivery.

 * Serve as a senior technical partner to engineering teams by influencing design decisions, guiding remediation strategy, and helping embed security into how software is built and deployed.

 * Advance CDW's approach to securing AI-enabled development and applications by evaluating emerging risks, defining practical guardrails, and promoting responsible use of AI as a force multiplier for engineering and security outcomes.

 * Provide deep subject matter expertise in API security, including authentication and authorization models, protections, monitoring, and secure integration patterns across modern application ecosystems.

 * Partner with web and platform teams to design, deploy, and tune application-layer protections such as WAF rules and policies.


## Related Videos

- [Infrastructure as Code: The Developer's Secret Weapon](https://www.wearedevelopers.com/videos/1221-infrastructure-as-code-the-developer-s-secret-weapon)
- [From DevOps to Scaled DevOps: How We’re Rebuilding Continuous Delivery as a Platform](https://www.wearedevelopers.com/videos/100018-from-devops-to-scaled-devops-how-we-re-rebuilding-continuous-delivery-as-a-platform)
- [What the Heck is Edge Computing Anyway?](https://www.wearedevelopers.com/videos/593-what-the-heck-is-edge-computing-anyway)
- [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see)
- [Implementing Feature Environments with AWS and Terraform](https://www.wearedevelopers.com/videos/531-implementing-feature-environments-with-aws-and-terraform)
- [DevOps Maturity Check – a way to balance autonomy and alignment](https://www.wearedevelopers.com/videos/58-devops-maturity-check-a-way-to-balance-autonomy-and-alignment)

## Related Articles

- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [What is Software Engineering in the Age of AI?](https://www.wearedevelopers.com/magazine/640-what-is-software-engineering-in-the-age-of-ai)
- [Navigating the AI Shift](https://www.wearedevelopers.com/magazine/629-navigating-the-ai-shift)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Transforming Software Development: The Role of AI and Developer Tools](https://www.wearedevelopers.com/magazine/527-transforming-software-development-the-role-of-ai-and-developer-tools)
- [Exploring AI: Opportunities and Risks for Developers](https://www.wearedevelopers.com/magazine/522-exploring-ai-opportunities-and-risks-for-developers)