Application Security Engineer

We are a large, diversified organization with a broad portfolio of businesses, brands, and digital products operating across multiple industries. Our technology and cybersecurity teams support a complex enterprise environment while giving individual business units the flexibility to operate and innovate within their own markets.

As our application security program continues to evolve, we are investing in modern security tooling, automation, and AI-assisted capabilities that help development teams build and deploy securely without slowing delivery.

Why join us?

Build, don’t just maintain. You’ll have an opportunity to help shape and mature an enterprise AppSec program rather than simply inherit a fully established environment. Work across a highly diverse technology ecosystem. The organization supports multiple businesses and development teams, creating exposure to a wide variety of applications, technology stacks, and security challenges. Bring AI into real-world security workflows. This team is actively exploring how AI can improve application security operations, from smarter triage to automated testing and remediation. High visibility and meaningful impact. Your work will influence how development teams across the organization approach secure software development and will be visible to senior technology and security leadership. Technical depth with strategic influence. This role combines hands-on engineering with the opportunity to establish standards, influence development leaders, and help determine the future direction of the AppSec program., We are seeking an experienced Application Security Engineer to play a key role in building and scaling our application security program.

This position will have visibility across the full AppSec lifecycle, from discovering and inventorying applications across the enterprise to implementing security tooling, integrating controls into CI/CD pipelines, and helping development teams adopt secure engineering practices.

This is not a purely heads-down technical role. The right person will be equally comfortable working with security tools and code as they are partnering with engineering leaders across independent business units. Success will require technical depth, strong communication skills, and the ability to influence teams without direct authority.

This is a hybrid position requiring three days per week onsite at one of our designated offices.

What You’ll Do Lead application discovery and inventory efforts across multiple business units, including application ownership mapping, technology stack profiling, and risk tiering. Implement, integrate, and operate modern application security tooling, including SAST, SCA, secrets scanning, container security, and Infrastructure-as-Code scanning. Embed security tooling and controls directly into CI/CD pipelines to make security part of the development lifecycle rather than a separate process. Design and implement AI-assisted triage workflows to help prioritize findings, reduce false positives, and prevent development teams from becoming overwhelmed by security alerts. Establish and evolve secure SDLC standards, threat modeling practices, security requirements, and development gates. Partner closely with engineering and development leaders to create practical AppSec playbooks that improve security while supporting speed of delivery. Help shape the organization’s approach to AI within application security, including evaluating emerging capabilities such as AI-assisted code review, agentic security testing, automated security requirements, and remediation guidance. Develop meaningful metrics and executive-level reporting that connect application security initiatives to measurable reductions in business and technology risk.

7+ years of experience in application security, product security, or security engineering. 3+ years of experience supporting complex environments with multiple independent business units, brands, product groups, or engineering organizations. Hands-on experience implementing and operating modern AppSec tools such as Semgrep, Snyk, Checkmarx, Veracode, Apiiro, Ox Security, GitHub Advanced Security, or similar platforms. Code-level proficiency in at least three commonly used programming languages such as Python, JavaScript/TypeScript, Java, C#, or Go, with the ability to review code and effectively validate security findings. Strong scripting and automation skills, ideally in Python or a comparable language. Experience building integrations using REST APIs and working within CI/CD environments such as GitHub Actions, GitLab CI, Jenkins, or Azure DevOps. Demonstrated success influencing engineering teams and driving security adoption without direct authority. Strong understanding of the OWASP Top 10, modern application attack patterns, software supply chain risks, and threat modeling methodologies such as STRIDE or PASTA. Preferred Qualifications Experience incorporating LLM or AI-based capabilities into security workflows, including alert triage, finding summarization, remediation guidance, or security automation. Familiarity with security and compliance frameworks such as HITRUST, HIPAA, NIST AI RMF, or SOC 2. Experience working within a regulated, healthcare, or healthcare-adjacent environment. Strong cloud security knowledge across AWS, Azure, or Google Cloud Platform. Contributions to the broader application security community through open-source projects, conference presentations, research, detection rules, or similar work.