> Markdown version of [/jobs/ext/3975777-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/3975777-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Application Security Engineer - **Company:** PACCAR Inc - **Location:** Renton, WA, United States - **Experience:** Expert - **Salary:** $90,000.0 - $141,000.0 - **Contract:** Permanent contract - **Skills:** HTML, JavaScript (Programming Language), Application Programming Interfaces (APIs), Agile Methodology, Amazon Web Services, Software System Penetration Testing, Application Portfolio Management, Automation of Tests, Microsoft Azure, Burp Suite, Cascading Style Sheets (CSS), Code Review, CompTIA Security+, Cyber Security, Information Systems, Cross-Origin Resource Sharing (Ajax Programming), Cross-Site Request Forgery, Github, Hypertext Transfer Protocols (HTTP), Information Systems Security Architecture Professional, Python (Programming Language), Kali Linux, Nmap, OAuth, Open Web Application Security, Systems Development Life Cycle, Fortify (Software), Security Assertion Markup Language (SAML), Secure Coding, Web Application Security, Software Engineering, SonarQube, Software Vulnerability Management, Web Applications, Web Services, Webinspect, Cloud Platform System, Software Security, Cross-Site Scripting (XSS), Git, Information Technology, Free and Open-Source Software, Checkmarx, Static Application Security Testing, Vulnerability Analysis, Dynamic Application Security Testing - **Published:** October 27, 2026 - **Apply:** https://www.adzuna.com/details/5885689081 ## About the Role + Bachelors degree in Computer Science, Information Systems, Software Engineering, Cybersecurity, or a related field. + 5+ years of professional experience in application or software security, including hands-on work in areas such as secure code review, vulnerability assessment, threat analysis, or secure development practices. + Hands-on experience with application security testing tools, including DAST platforms (e.g., Burp Suite, WebInspect, OWASP ZAP) and SAST/SCA tools (e.g., Fortify, Checkmarx, SonarQube). + Proficiency in one or more programming languages: C#, JavaScript, and/or Python. + Strong working knowledge of web application technologies including HTTP, HTML, CSS, JavaScript. + Expert-level understanding of the OWASP Top 10 and common web application vulnerabilities and website security concepts such as headers, cookies, CORS, XSS, CSRF. + Familiarity with web authentication technologies such as OAuth and/or SAML. + Experience with Software Development Life Cycle (SDLC) and development methodologies such as Waterfall and Agile. + Experience with control systems: Git, GitHub, Azure DevOps Preferred Experience + Experience working in a large enterprise environment. + Experience with penetration testing or security tools (e.g., Kali Linux, Nmap). + Familiarity with cloud environments such as Azure, AWS, or GCP. + Certified Secure Software Lifecycle Professional (CSSLP) + Certified Information Systems Security Professional (CISSP) + CompTIA Security+ ## Description As an Application Security Engineer, you will be a key member of the Global Security group within the IT Division at PACCAR and will be reporting directly to the Principal Engineer. You will provide security guidance to development teams, including secure code review and scanning, vulnerability assessments, and security testing to help application teams build and deploy secure applications and APIs. In this role, you will support security governance and help ensure adherence to application security controls and risk analysis across the organization's application portfolio throughout the SDLC. This includes internally developed applications, third-party developed applications, commercial off-the-shelf (COTS) solutions, and open-source software. You will utilize a risk-based methodology and "shift-left" approach to engage early in the software development lifecycle, working alongside engineering teams to help prevent security defects before they are introduced. You will contribute to a team culture that values openness, teamwork, continuous improvement, learning, commitment, and empathy. Job Functions / Responsibilities Security Assessments & Testing * Perform source code reviews using manual analysis and Static Application Security Testing (SAST) tools to identify vulnerabilities. * Execute web security assessments on websites, web applications, web services, and APIs using Dynamic Application Security Testing (DAST) tools. * Review test results from automated security tools, ensure automated tests complete successfully, and identify and remove false positives from tool reports. * Participate in developing and reviewing threat models to proactively identify security risks. Developer Engagement & Remediation * Engage with development teams to provide vulnerability remediation support through consultation or hands-on assistance. * Assist developers with understanding security defects, associated risk, and defining acceptable solutions to fix defects. * Collaborate with teams to integrate secure coding practices and security tooling into CI/CD pipelines. * Contribute to code reviews and design discussions with a security lens. Security Governance & Standards * Support adherence to application security controls and contribute to risk analysis of applications across the SDLC. * Participate in the creation, maintenance, and communication of PACCAR secure coding standards, guidelines, and examples. * Support the implementation of secure design principles according to organizational policies, standards, and application security patterns. * Assist in creating technical security documents including assessment reports and remediation guidance. Training & Culture * Share application security knowledge with the engineering team through brown bags, secure coding tournaments, and developer outreach activities. * Actively participate in improving security culture and awareness throughout the organization. * Participate in security incident response when needed. Tooling & Automation * Help maintain and tune Secure SDLC tools including SAST, DAST, and Software Composition Analysis (SCA) platforms. * Support the integration of security tooling and automated security checks within CI/CD pipelines. * Stay current with security technologies, products, and emerging trends relevant to application security.