> Markdown version of [/jobs/ext/2719286-application-security-auditor-devsecops-security-engineer](https://www.wearedevelopers.com/jobs/ext/2719286-application-security-auditor-devsecops-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Application Security Auditor / DevSecOps Security Engineer - **Company:** Xcelo Group Inc - **Location:** Windsor charter Township, MI, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Kubernetes Security, Java (Programming Language), .NET Framework, Application Programming Interfaces (APIs), Advanced Linux Sound Architecture, Amazon Web Services, Applications Architecture, User Authentication, Microsoft Azure, Cloud Computing, Cloud Computing Security, Cloud Engineering, Cross-Site Request Forgery, Programming Tools, Distributed Systems, Firefox, Hypertext Transfer Protocols (HTTP), IBM Websphere Application Server, Mobile Application Software, WildFly (JBoss AS), Node.Js, OAuth, OpenID, Oracle (Applications), Open Web Application Security, Programming Environments, Systems Development Life Cycle, Openid Connect, Fortify (Software), Secure Coding, Software Engineering, Data Streaming, Software Vulnerability Management, Web Applications, Extensible Markup Language (XML), Computer Networking Systems, Google Cloud, Enterprise Software Applications, ReactJS, Spring-boot, Software Security, Cross-Site Scripting (XSS), Backend, Containerization, AngularJS, Information Technology, Front End Software Development, Restful APIs, Devsecops, Security Orchestration, Automation & Response, Static Application Security Testing, Vulnerability Analysis, Dynamic Application Security Testing - **Published:** September 4, 2026 - **Apply:** https://www.dice.com/job-detail/0c9df2a3-baf9-4f8e-8b08-fbbfdf8d40d5 ## About the Role * 7+ years of overall IT / Application Security experience preferred * Minimum 5+ years of total IT experience * At least 3+ years of hands-on Application Security, Secure Coding, and DevSecOps experience, The ideal candidate should have hands-on experience with SAST, DAST, SCA, ASOC, API security, OWASP vulnerabilities, secure coding frameworks, and security automation., * Experience with: + Secure application development + Networking infrastructure + Security automation + DevSecOps + Secure SDLC * Hands-on experience designing, developing, assessing, or securing distributed web and mobile applications. * Ability to use browser developer tools such as Chrome, Firefox, and Microsoft Edge DevTools to analyze requests, responses, headers, cookies, and application behavior. Preferred Skills * Experience with security tools such as: + Coverity + Black Duck + Fortify + SRM * Strong knowledge of API Security. * Experience with: + JWT + OAuth 2.0 + OpenID Connect (OIDC) + PKCE + API replay attack prevention * Understanding of container technologies and container security. * Cloud development or security experience with: + Microsoft Azure + AWS + Google Cloud Platform (Google Cloud Platform) ## Description We are seeking a highly experienced Senior Application Security Auditor with strong expertise in application security testing, secure software development, DevSecOps, API security, vulnerability assessment, and secure coding practices. This is not a traditional SOC-focused role. The position will work directly with software engineering teams to identify and remediate security vulnerabilities across front-end, back-end, API, cloud, containerized, and distributed applications., + Cloud Security * Strong understanding of HTTP request/response headers for web applications and REST APIs. * Deep understanding of the OWASP Top 10, including the ability to explain vulnerabilities, attack vectors, and remediation approaches. * Experience identifying and mitigating vulnerabilities such as: + Cross-Site Scripting (XSS) + Injection attacks + Server-Side Request Forgery (SSRF) + Cross-Site Request Forgery (CSRF) + XML External Entity (XXE) + Authentication and authorization vulnerabilities + API security vulnerabilities * Experience implementing secure coding standards and security guidance including: + OWASP Top 10 + SANS + CERT Secure Coding + CWE Top 25 + CIS Critical Security Controls + Cloud Security Alliance + SAFECode * Strong understanding of secure software development practices across technologies such as: + Angular + React + Node.js + Java + Spring Boot + IBM WebSphere Application Server + Oracle + JBoss + .NET * Experience with both compiled and interpreted programming environments., * Perform Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) across enterprise applications. * Conduct security assessments of web, mobile, API, cloud, and distributed applications. * Work closely with development teams to identify vulnerabilities and recommend secure coding remediation strategies. * Review application architecture, code, APIs, authentication, authorization, and data flows from a security perspective. * Guide developers on secure coding standards, OWASP vulnerabilities, threat mitigation, and secure SDLC practices. * Partner with front-end, back-end, API, cloud, and platform engineering teams to integrate security throughout the software development lifecycle. * Implement and promote reusable application security patterns and secure development practices. * Integrate security scanning and validation into DevSecOps and CI/CD pipelines. * Automate secure configuration validation, compliance checks, application security testing, and authorization processes. * Evaluate REST APIs for authentication, authorization, token management, JWT, OAuth/OIDC, replay attacks, and common API vulnerabilities. * Analyze HTTP requests and responses to identify security weaknesses. * Help mature the organization's Secure Software Development Lifecycle (SSDLC). * Support continuous compliance and application risk mitigation initiatives. * Collaborate with distributed engineering teams to improve how applications are designed, developed, secured, deployed, and operated. * Provide technical guidance on vulnerability remediation and security best practices. ## Related Videos - [Keeping applications secure by evolving OAuth 2.0 and OpenID Connect](https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect) - [Watch Tests Go Brrrr! : Getting Started with Cypress in ReactJS](https://www.wearedevelopers.com/videos/282-watch-tests-go-brrrr-getting-started-with-cypress-in-reactjs) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Get started with securing your cloud-native Java microservices applications](https://www.wearedevelopers.com/videos/123-get-started-with-securing-your-cloud-native-java-microservices-applications) - [Delegating the chores of authenticating users to Keycloak](https://www.wearedevelopers.com/videos/1558-delegating-the-chores-of-authenticating-users-to-keycloak) - [Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue](https://www.wearedevelopers.com/videos/1637-delay-the-ai-overlords-how-oauth-and-openfga-can-keep-your-ai-agents-from-going-rogue) ## Related Articles - [The 8 Best Code Testing Tools](https://www.wearedevelopers.com/magazine/402-the-8-best-code-testing-tools) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)