Security Engineer

Hudson

Albany, United States

5 days ago

Apply on www.dice.com

Prepare application

Role details

Contract type

Permanent contract

Employment type

Full-time (> 32 hours)

Experience level

Expert

Experience required

6 years minimum

Working hours

Regular working hours

Job source

www.dice.com

Tech stack

Java (Programming Language) Application Programming Interfaces (APIs) Artificial Intelligence Software as a Service Cyber Security Continuous Integration Java Platform Enterprise Edition (J2EE) Open Web Application Security Systems Development Life Cycle Fortify (Software) Secure Coding Session Management

+11 more

Software Engineering SonarQube Software Vulnerability Management Web Applications Transport Layer Security Java Application Server Enterprise Software Applications Software Security Information Technology Static Application Security Testing Dynamic Application Security Testing

Job description

The Application Security Engineer is responsible for integrating security into the design, development, testing, and delivery of large-scale Java applications. This role is focused on secure software engineering, application security analysis, vulnerability remediation, and strengthening security practices throughout the SDLC., * Review Java application code, design, and architecture for security weaknesses and recommend corrective action.
Analyze SAST, DAST, and other application-security findings and work with Development teams to prioritize and remediate issues.
Provide secure coding guidance and practical remediation recommendations to developers.
Partner with Development and Testing teams to integrate security checks and validation into delivery pipelines and test practices.
Validate remediation and help distinguish true vulnerabilities from false positives or non-exploitable findings.
Support secure SDLC practices, application security standards, and continuous improvement activities.
Review application changes, APIs, authentication/authorization patterns, and other security-sensitive functionality.
Monitor relevant Java vulnerabilities, third-party component risks, and published NIST CVEs.
Document findings, risk, remediation guidance, and validation results for technical and non-technical stakeholders.

Requirements

The successful candidate should bring prior Java development or architecture experience and be able to work directly with Development and Testing teams on secure coding, code and architecture review, SAST/DAST findings, remediation, and security integration within CI/CD., * Bachelor’s degree in Computer Science, Information Security, Software Engineering, or a related technical field.
6+ years of combined software Development and/or Application Security experience.
Prior hands-on Java/J2EE development or architecture experience.
Experience supporting security for large-scale, public-facing enterprise applications.
Experience working directly with Development teams to analyze and remediate application vulnerabilities. REQUIRED TECHNICAL / FUNCTIONAL SKILLS
Strong Core Java/J2EE development knowledge and ability to understand application code, frameworks, and architecture.
Application security analysis including secure code review, pull-request review, and/or architecture/design review.
Secure coding practices and common web application vulnerabilities, including OWASP risks.
Hands-on experience analyzing SAST/DAST findings; familiarity with tools such as Fortify on Demand and SonarQube.
Ability to determine whether security-tool findings are relevant, exploitable, false positives, or require remediation.
Experience integrating application security activities into CI/CD and the software development lifecycle.
Experience partnering with Development and Testing teams on remediation, validation, and security testing.
Understanding of authentication, authorization, session management, APIs, cryptography, and SSL/TLS.
Ability to clearly document risk, technical findings, remediation guidance, and validation results., * Fortify on Demand, SonarQube, or comparable SAST/DAST tooling.
Software Composition Analysis (SCA) and Software Bill of Materials (SBOM) experience.
API security testing and secure design review.
Cloud application security experience.
Relevant application-security certification.
HIPAA or other regulated-environment experience.
AI-assisted application-security tools, with manual validation of findings. CANDIDATE PROFILE
Candidate should clearly explain a current/recent Java application and their individual Application Security responsibilities.
Candidate should provide specific examples of code, architecture, SAST/DAST, or secure-design findings they personally analyzed.
Candidate should explain how they determined whether a finding represented real risk and how they worked with Development on remediation.

Apply for this position

This job is hosted externally. Click below to view the full posting and apply.

Apply on www.dice.com

Prepare application

Good distractions

Loading talks and stories from around this role…