Application Security Engineer-Policy & Platform

Position Overview: Seeking a senior Application Security Engineer to support AppSec platform operations, vulnerability analysis, and security policy configuration. This individual will work within enterprise application security tools to configure policies, determine when vulnerabilities should generate tickets, tune detection criteria, validate findings, and support development teams with remediation.

• General network, infrastructure, or cloud security experience alone will not substitute for Application Security experience.
• Strong Application Security experience, ideally 6 10+ years, with a preference for more than six years.
• Hands-on experience analyzing SAST and SCA findings.
• Experience configuring or tuning vulnerability policies within application security platforms.
• Ability to investigate vulnerabilities, identify false positives, and assess technical findings.
• Understanding of Secure SDLC, DevSecOps, CI/CD pipelines, and application security controls.
• Ability to read and understand source code to evaluate vulnerabilities. Extensive software development experience is not required.
• Familiarity with Infrastructure as Code (IaC), security tooling integrations, and automated vulnerability ticketing.
• Experience collaborating with developers and engineering teams on security findings and remediation.

Manager Feedback:

• This is a hands-on technical AppSec position focused on policy configuration, platform operations, and vulnerability analysis.
• A major responsibility involves working within AppSec tools to configure policies that determine whether findings generate tickets, are excluded, or require additional action.
• Candidates should understand how security platforms integrate with development and ticketing systems, but they do not necessarily need to build or maintain those integrations themselves.
• Strong SAST/SCA experience is important, particularly the ability to read code and determine whether reported vulnerabilities are legitimate.
• Candidates do not need 10 years of software development experience, but they should be comfortable reading at least one programming language. Java or another language is acceptable.
• The manager is flexible on specific AppSec tools if the candidate has comparable platform and policy configuration experience.
• CISSP was emphasized as a strong baseline certification. CSSLP, GWEB, and similar AppSec certifications are also valuable.