> Markdown version of [/jobs/ext/2617516-security-engineer-application-security](https://www.wearedevelopers.com/jobs/ext/2617516-security-engineer-application-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Engineer, Application Security - **Company:** Saronic Technologies - **Location:** Austin, TX, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Amazon Web Services, Software Applications, Microsoft Azure, Cloud Computing, Cloud Computing Security, Code Review, Continuous Integration, DevOps, Key Management, Systems Development Life Cycle, Secure Coding, Software Engineering, Enterprise Software Applications, Software Security, Devsecops, Static Application Security Testing, Dynamic Application Security Testing - **Published:** August 4, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=0a43b2f170e90f54 ## About the Role * 5+ years in application security, DevSecOps, or product security, or an equivalent combination of experience and demonstrated ability * Hands-on secure SDLC: threat modeling, secure code review, and SAST/DAST/SCA in CI/CD * Software supply-chain security (SCA/SBOM/signing) and secrets management * Experience securing the deployment and self-hosting of applications (hardened images, isolation, identity, patching, monitoring) * Comfortable in scripting and Infrastructure-as-Code so you can build durable tooling, not one-off commands and clicks * Ability to obtain and maintain a U.S. security clearance, * Container and cloud security; application allowlisting * Securely self-hosting or delivering applications to customers across AWS, Azure, and on-prem * An attacker's mindset; bug-bounty triage experience * Experience in defense, aerospace, or other high-assurance environments ## Description Security at Saronic is a force multiplier, not a blocker. We're looking for a Security Engineer for Application Security to empower our teams to ship fast without trading away safety to secure the software development lifecycle and supply chain across product, cloud, and enterprise systems. The software org ships rapidly and rely on the security team to provide guardrails to enable that speed and scale safely. You'll be that owner, and you'll fix whole classes of problems rather than chasing one bug at a time. You'll partner closely with Software, DevOps, Cloud, and Platform Engineering to make secure the default, not the exception., * Secure SDLC & DevSecOps: Run threat modeling and secure design and code reviews for new and existing systems. Integrate SAST, DAST, and SCA into CI/CD and secure pipelines from commit to deploy with gates that developers actually welcome. * Software Supply Chain: Own dependency and supply-chain security: SCA, SBOMs, artifact signing and provenance, and reducing accumulated dependency and secrets exposure. * Secrets & Application Controls: Govern secrets management, application allowlisting/blocklisting, and support data-loss-prevention through software controls. * Secure Self-Hosting Infrastructure: Design and harden the infrastructure and patterns for securely self-hosting software applications, for internal enterprise use, embedded within our products, and delivered to our customers, across AWS, Azure, and on-prem. Provide hardened base images, network isolation, identity and secrets management, patching, and monitoring so any team can stand up a self-hosted application securely by default instead of routing every request through manual review. * Partnership: Embed with engineering teams and build the tooling that scales security across the org. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [DevSecOps: Injecting Security into Mobile CI/CD Pipelines](https://www.wearedevelopers.com/videos/273-devsecops-injecting-security-into-mobile-ci-cd-pipelines) - [From DevOps to Scaled DevOps: How We’re Rebuilding Continuous Delivery as a Platform](https://www.wearedevelopers.com/videos/100018-from-devops-to-scaled-devops-how-we-re-rebuilding-continuous-delivery-as-a-platform) - [Are Code Reviews Worth It? Insights from 16 Years of Review Data](https://www.wearedevelopers.com/videos/1135-are-code-reviews-worth-it-insights-from-16-years-of-review-data) - [DevSecOps culture](https://www.wearedevelopers.com/videos/783-devsecops-culture) - [DevSecOps: Security in DevOps](https://www.wearedevelopers.com/videos/36-devsecops-security-in-devops) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)