> Markdown version of [/jobs/ext/4479026-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/4479026-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Application Security Engineer

- **Company:** Turquoise Health
- **Location:** United States (Remote available)
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Amazon Web Services, Software System Penetration Testing, Code Review, Software Debugging, Python (Programming Language), Open Web Application Security, Systems Development Life Cycle, Red Team (Cyber Security), Software Engineering, Scripting, Cloud Platform System, Software Security, GWAPT, Terraform, Static Application Security Testing, Golang, Dynamic Application Security Testing
- **Published:** October 4, 2026
- **Apply:** https://startup.jobs/senior-application-security-engineer-turquoise-10283139

## About the Role

* 5+ years of experience in application security, security engineering, or a related software engineering role with a security focus.
 * Hands-on experience with SAST, DAST, and dependency/SCA scanning tools, and the judgment to distinguish real risk from noise.
 * Deep understanding of common vulnerability classes (OWASP Top 10, authentication/authorization flaws, injection, SSRF, etc.), including the ability to review code and architecture to spot these issues and propose effective fixes.
 * Experience with cloud environments (AWS preferred) and securing modern CI/CD pipelines.
 * Strong communication skills, able to explain risk and remediation steps clearly to engineers and non-security stakeholders alike.
 * A collaborative, pragmatic approach to security that balances risk reduction with shipping velocity.

Nice to Have

 * Experience in healthcare, fintech, or another regulated industry.
 * Experience working within compliance frameworks such as HIPAA, SOC 2, or GDPR.
 * Security certifications such as OSCP, GWAPT, or CSSLP.
 * Experience building or maturing an AppSec program from an early stage.
 * Scripting or automation experience (Python, Go, Terraform, or infrastructure-as-code tool like Terraform.
 * Red team experience performing internal campaigns and providing remediation reports

## Description

* Build and run our application security scanning program (SAST, DAST, dependency/SCA, container and IaC scanning), tuning tools to reduce noise and surface real risk.
 * Triage findings from scans, penetration tests, and bug bounty reports; prioritize by risk and track remediation through to closure.
 * Partner with engineering teams to fix vulnerabilities, including hands-on debugging and code-level guidance when needed.
 * Build trust and cooperation with engineering, product, and design teams so security is considered early in the process, not bolted on at the end (mature SDLC, CI/CD pipelines).
 * Perform threat modeling and maintain secure-coding standards.
 * Support incident response for application-layer security issues.
 * Coordinate and help manage third-party penetration tests.
 * Track and report on security posture metrics (open vulnerabilities, remediation SLAs, scan coverage) to engineering and leadership.