> Markdown version of [/jobs/ext/4213487-security-engineer-application-security](https://www.wearedevelopers.com/jobs/ext/4213487-security-engineer-application-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Engineer (Application Security) - **Company:** Blue Cross Blue Shield Association - **Location:** Chicago, IL, United States - **Experience:** Expert - **Salary:** $118,500.0 - $171,825.0 - **Contract:** Permanent contract - **Skills:** Java (Programming Language), JavaScript (Programming Language), Application Programming Interfaces (APIs), Amazon Web Services, Microsoft Antivirus, ARM Architecture, Microsoft Azure, Bash Shell, Burp Suite, Business Software, C Sharp (Programming Language), Cloud Computing, Cloud Computing Security, Cloud Engineering, Cyber Security, Federal Information Processing Standards (FIPS), Github, Python (Programming Language), Node.Js, OpenShift, Open Web Application Security, Windows PowerShell, Fortify (Software), Secure Coding, Shell Script, SoapUI, Software Engineering, SonarQube, SQL Databases, Tripwire, TypeScript, Software Vulnerability Management, YAML, Test-Driven Development (TDD), Postman, Software Security, Veracode, AngularJS, Kubernetes, Information Technology, Github Enterprise, Bicep, Checkmarx, Terraform, Prisma Cloud Platform, Devsecops, Azure Resource Manager, Docker, Jenkins, Servicenow, Static Application Security Testing, Vulnerability Analysis, Golang, Microservices, Dynamic Application Security Testing - **Published:** October 12, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=c00d7a111fdf4824 ## About the Role * Required Bachelor's Degree in Computer Science, Information Security, or related field or equivalent work experience., * Required 5+ Years Cybersecurity experience with a preferred focus on application security, vulnerability assessments, and secure software development practices * Experience implementing risk remediation prioritization and collaboration with key stakeholders to understand risk drivers and remediation blockers. * Experience monitoring and tracking remediation efforts, staying abreast of emerging threats, and leading the design, implementation, and maintenance of domain specific toolsets. * Experience conducting Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), Software Bill of Materials (SBOM) analysis, API security assessments, secure code reviews, threat modeling, and risk assessments. * Experience managing the Application Vulnerability Assessment (AVA) cycle, including planning, vulnerability validation and rating, reporting, remediation guidance and tracking, and validation of fixes. * Experience assessing cloud-native, web, API, containerized, and microservices-based applications across Azure, AWS, Kubernetes, and OpenShift. * Experience working with internal and external auditors and Governance, Risk, and Compliance (GRC) teams to provide assessment evidence, address findings, and support compliance activities. * Experience with Infrastructure as Code technologies, including Terraform, Bicep, ARM Templates, YAML, Docker, Kubernetes manifests, and Helm, and the ability to develop automation and security testing scripts. Knowledge Skills and Abilities * Ability to plan, develop, implement and update company's information security strategy. * Excellent communication skills * Excellent presentation skills that cater to technical and non-technical audiences. * Advanced analytical and problem-solving skills and ability to manage multiple projects successfully, ensuring timely and budget-friendly completion. * Effective interpersonal skills, and the ability to influence and solve problems effectively. * Solid understanding of HIPAA/HITRUST requirements, cloud-first security practices, and various security tools and technologies. * Advanced knowledge of application security principles and standards, including OWASP Top 10, OWASP API Security Top 10, OWASP ASVS, NIST Cybersecurity Framework, HIPAA, HITRUST, FedRAMP, FISMA, FIPS, and AICPA SOC reporting requirements. * Proficiency with application security testing and assessment tools such as Burp Suite, OWASP ZAP, Checkmarx, Veracode, Fortify, GitHub Advanced Security, SonarQube, Postman, and SoapUI. * Knowledge of software supply chain, cloud, container, and vulnerability management security tools, including Snyk, Mend/WhiteSource, Black Duck, Dependabot, JFrog Xray, Cortex Cloud, Prisma Cloud, Tenable Cloud Security, Wiz, Aqua Security, Trivy, Microsoft Defender for Cloud, Tenable Vulnerability Management, Brinqa, and ServiceNow Vulnerability Response. * Knowledge of DevSecOps platforms and practices, including GitHub Enterprise, GitHub Actions, Azure DevOps, Jenkins, secure software testing, and test-driven development (TDD). * Ability to review and assess code written in Python, Java, JavaScript, TypeScript, Node.js, AngularJS, C#, PowerShell, Go, SQL, Bash, and other commonly used shell scripting languages. * Ability to identify and assess vulnerabilities such as authentication flaws, authorization weaknesses, insecure APIs, injection attacks, secrets exposure, cloud misconfigurations, and container security risks. * Ability to communicate technical findings to developers and translate risk, impact, and remediation guidance for business and other non-technical stakeholders. * Ability to drive continuous improvement of application security capabilities, vulnerability management processes, remediation validation, and enterprise risk visibility. * Preferred: Demonstrates AI literacy and an understanding of generative AI tools, including appropriate business applications and limitations. ## Description This specific role will apply application security engineering, assessment, and secure software development practices across cloud-native, web, API, containerized, and microservices-based applications. It supports the application vulnerability assessment lifecycle and integrates security controls and testing throughout the software development lifecycle and DevSecOps pipelines., * Works with Architects and key stakeholders to interpret engineering and operational guidance in a specific security domain/program and contributes to multiple projects related to it. * Lead the creation of comprehensive roadmaps for multiple projects or departments. * Champion operational excellence by designing and executing process improvement initiatives. * Drive significant cost optimization efforts by identifying and implementing strategic savings opportunities. * Enhance security risk visibility by developing and overseeing robust risk management frameworks. * Participate in domain related incident response efforts as needed, maintain defined security architecture, and manage domain specific security tools. The posting range for this position is: 118,500.00 - 171,825.00