Application Security Engineer

These Application Security Engineers will be focused on a security remediation initiative addressing an existing backlog of hard- coded secrets and credential exposure findings across GitHub source-code repositories. Automated detection is already in place through GitHub Advanced Security (Enterprise) Secret Scanning. The focus is not building a new detection solution, but taking existing findings through investigation, validation, remediation coordination, documentation, and final disposition.

Additionally, these engineers will partner with application security, software development, platform engineering, application owners, and other stakeholders to assess risk, determine ownership, coordinate remediation, and drive findings to documented closure. Successful candidates must be able to contribute meaningfully from day one.

• 3+ years of hands-on Application Security experience in an AppSec or DevSecOps environment.
• Strong understanding of secrets exposure, credential risk, secure validation, revocation/rotation, and secrets-management practices.
• Strong knowledge of GitHub and Git source control, including repositories, branches, commits, pull requests, permissions, and repository history.
• Practical experience integrating with or working through GitHub REST APIs.
• Hands-on scripting experience with at least two of the following strongly preferred: PowerShell, Bash, Python.
• Ability to understand, modify, and extend existing scripts rather than relying solely on prebuilt tooling.
• Ability to prioritize a large, potentially ambiguous remediation backlog and drive findings to documented closure.
• Strong written/verbal communication and the ability to work directly with software engineers, platform teams, and technical stakeholders.
• High attention to detail and sound judgment when handling sensitive security information.
• Ability to work independently and hit the ground running in a short-duration engagement.
• Hands-on experience with GitHub Advanced Security (Enterprise) and Secret Scanning.
• Experience remediating hard-coded secrets or exposed credentials within source-code repositories.
• Familiarity with AWS and Azure security environments, including AWS Secrets Manager and Azure Key Vault concepts.
• Experience with CI/CD pipelines, cloud identity services, security ticketing, and governance workflows.
• Familiarity with cloud access keys, PATs, OAuth credentials, SSH/private keys, database credentials, and certificates.
• Experience with AppSec remediation metrics, backlog reporting, or workflow automation.
• Experience partnering across large software engineering organizations.