> Markdown version of [/jobs/ext/3762298-security-engineer-app-dev-onsite](https://www.wearedevelopers.com/jobs/ext/3762298-security-engineer-app-dev-onsite). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Engineer (App Dev)- onsite

- **Company:** Calance Consulting Corporation
- **Location:** Irvine, CA, United States
- **Contract:** Contract
- **Skills:** Amazon Web Services, Amazon S3, Cloud Engineering, Cyber Security, Continuous Integration, Data Validation, Identity and Access Management, Python (Programming Language), OpenID, Open Web Application Security, Security Information and Event Management, Policy as Code, Software Security, Amazon Virtual Private Cloud (VPC), Cloudformation, Production Code, Terraform
- **Published:** October 15, 2026
- **Apply:** https://www.dice.com/job-detail/6fc8e570-5279-4c3f-bcf3-f0a1a378f203

## About the Role

oRelevant certs (AWS Security Specialty, OSCP, CKS)
oCompliance exposure (SOC 2, ISO 27001, FedRAMP) a plus
oFamiliarity with CSPM or cloud-native runtime security tools

## Description

oDeep IAM fluency: least-privilege policy design, roles vs. users, permission boundaries, cross-account trust, and spotting over-privileged automation identities
oHands-on with the AWS security stack: GuardDuty, Security Hub, CloudTrail, Config, Inspector, KMS, Secrets Manager, VPC/network controls
oUnderstands the shared responsibility model and where the application s exposure actually sits (S3 policies, security groups, public endpoints, etc.)

Automation and infrastructure-as-code
oCan read and review Terraform/CloudFormation/CDK/etc, and knows how to put security checks into the pipeline (tfsec, Checkov, policy-as-code like OPA)
oComfortable auditing Lambda, Step Functions, EventBridge, and scheduled jobs for insecure defaults, secret sprawl, and excessive permissions
oTreats CI/CD as an attack surface: pipeline credentials, OIDC federation, artifact integrity, supply-chain risk

Secure engineering
oCan write production-quality code (Python, Go, or similar) and can build security tooling
oExperience with threat modeling for event-driven and service-to-service architectures, including non-human identities and machine-to-machine auth
oKnows application security basics: OWASP, auth/session handling, input validation, dependency and container scanning
oExperience setting up/running CSPM(s), policy tuning, etc

Detection and response
oCan design alerting from CloudTrail/VPC flow logs/application logs and has experience integration into SIEM platform(s)
oHas run or participated in incident response in a cloud environment and can automate containment steps

Working style
oPragmatic about risk: prioritizes by actual exploitability and blast radius
oCommunicates clearly with developers and explains the why so fixes stick
oIs comfortable documenting controls and work guidance documents to aid in awareness of achieving of a more secure control environment.
oMust be comfortable working and reporting to the Sr Director of Information Security, with a "dotted line" to the application team leadership.