> Markdown version of [/jobs/ext/4571159-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/4571159-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Application Security Engineer

- **Company:** Ova Technologies
- **Location:** New York, NY, United States
- **Contract:** Permanent contract
- **Skills:** Java (Programming Language), JavaScript (Programming Language), PHP (Programming Language), Application Programming Interfaces (APIs), Software Applications, Software System Penetration Testing, Burp Suite, C Sharp (Programming Language), Cloud Computing Security, Cross-Site Request Forgery, Data Validation, DevOps, Github, Mobile Application Software, Python (Programming Language), Nmap, OAuth, Object-Oriented Software Development, OpenID, Open Web Application Security, Systems Development Life Cycle, Openid Connect, Fortify (Software), Secure Coding, Web Application Security, Session Management, Software Engineering, SonarQube, SQL Injection, Tripwire, TypeScript, Extensible Markup Language (XML), Software Security, Veracode, Cross-Site Scripting (XSS), Backend, Rate Limiting, Kotlin, Containerization, Nessus, Graphql, Checkmarx, Api Gateway, Restful APIs, Devsecops, Static Application Security Testing, Vulnerability Analysis, Programming Languages, Dynamic Application Security Testing
- **Published:** November 4, 2026
- **Apply:** https://www.thejobnetwork.com/job/107ac65b-a815-426b-bf6b-3d90a2f8fd6e/application-security-engineer

## About the Role

* Secure Software Development Life Cycle (SSDLC)
 * Secure Coding Practices
 * Threat Modeling
 * Secure Design Principles, * Dynamic Application Security Testing (DAST)
 * Interactive Application Security Testing (IAST)
 * Software Composition Analysis (SCA)
 * Runtime Application Self-Protection (RASP)
 * Mobile Application Security Testing (MAST)
 * API Security Testing

Security Tools

 * Burp Suite
 * OWASP ZAP
 * Checkmarx
 * Veracode
 * Fortify
 * SonarQube
 * Snyk
 * GitHub Advanced Security
 * Semgrep
 * Trivy
 * Nessus
 * Nmap

Programming Languages

Knowledge of one or more:

 * Java
 * Python
 * C#
 * JavaScript
 * TypeScript
 * Go
 * PHP
 * Kotlin
 * Swift

Understanding of:

 * Object-Oriented Programming (OOP)
 * Secure Coding Standards
 * Input Validation
 * Error Handling

Web Security

 * OWASP Top 10
 * SQL Injection (SQLi)
 * Cross-Site Scripting (XSS)
 * Cross-Site Request Forgery (CSRF)
 * Server-Side Request Forgery (SSRF)
 * XML External Entity (XXE)
 * Insecure Direct Object References (IDOR)
 * Remote Code Execution (RCE)
 * Command Injection
 * Clickjacking
 * Content Security Policy (CSP)

API Security

 * REST API Security
 * GraphQL Security
 * OAuth 2.0
 * OpenID Connect (OIDC)
 * JWT
 * API Gateway Security
 * Rate Limiting
 * API Authentication & Authorization

## Description

We are seeking an experienced Application Security Engineer to ensure the security of software applications throughout the Software Development Life Cycle (SDLC). The ideal candidate will identify security vulnerabilities, conduct secure code reviews, perform application security testing, implement DevSecOps practices, and collaborate with development teams to build secure applications., * Integrate security practices into the SDLC (Secure SDLC).

 * Perform Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA).
 * Conduct secure code reviews for web, mobile, and backend applications.
 * Identify, assess, and remediate application security vulnerabilities.
 * Perform threat modeling and security risk assessments.
 * Implement DevSecOps security controls in CI/CD pipelines.
 * Conduct penetration testing and vulnerability assessments.
 * Validate authentication, authorization, session management, and API security.
 * Secure cloud-native and containerized applications.
 * Collaborate with developers, DevOps, QA, and infrastructure teams.
 * Develop security standards, guidelines, and best practices.
 * Support compliance with industry regulations and security frameworks.