> Markdown version of [/jobs/ext/4620879-lead-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/4620879-lead-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Lead Application Security Engineer

- **Company:** Apollo
- **Location:** New York, NY, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Applications Architecture, Software System Penetration Testing, Automation of Tests, Burp Suite, Software as a Service, Code Review, Cyber Security, Github, Open Web Application Security, Systems Development Life Cycle, Secure Coding, Software Engineering, Cloud Platform System, Software Security, Mitre Att&ck, Information Technology, Software Version Control, Static Application Security Testing, Dynamic Application Security Testing
- **Published:** November 7, 2026
- **Apply:** https://www.juju.com/job/28_25197_1a789c583e006a4358254f830fd84581

## About the Role

* 10+ years of hands-on experience in Application Security, with a strong background in software development (IDE/CLI environments).
 * Bachelor's degree in Computer Science, Information Technology, Information Security, or a related field.
 * Demonstrated success partnering with software development teams to provide security oversight across complex application ecosystems.
 * Proven expertise with IDEs, version control systems, CI/CD pipeline management, secure SDLC practices, and SaaS-based security tools (SCA, SAST, DAST) as well as application inventory management.
 * Experience with Snyk and GitHub is highly desirable.
 * Strong understanding of application architecture, security controls, cloud environments, and penetration testing methodologies.
 * Exceptional collaboration and critical thinking skills, with the ability to operate effectively in a fast-paced, dynamic environment.
 * Familiarity with leading security standards and frameworks (OWASP, NIST, ISO 27001, MITRE ATT&CK) and testing tools such as Burp Suite.
 * Experience working within or alongside regulated industries (e.g., financial services) and understanding their impact on application security practices.
 * Ongoing commitment to staying informed on emerging threats and trends to proactively enhance security measures.
 * Professional certifications such as CISSP, CSSLP, CASE, GWEB, or MCSA/MCSE are strongly preferred.

## Description

You will oversee the design and operation of a scalable application security program, partnering closely with engineering, security, and business teams to embed security throughout the software lifecycle., * Application Threat Modeling: Lead threat modeling for new and existing applications to identify risks, recommend mitigations, and ensure control alignment with enterprise standards.

 * Application Design & Architecture: Guide teams in secure design principles, validate adherence to security controls, and ensure threat models inform architectural decisions.
 * Secure SDLC Development & Implementation: Define and implement secure development lifecycle (SDLC) processes and tools-including SAST, SCA, and secret scanning-and drive adoption across development teams.
 * Operationalization of Security Tools: Integrate and maintain security tooling to streamline analysis, reporting, and remediation workflows throughout the software lifecycle.
 * Application Security Awareness & Enablement: Build and sustain a security champion program, fostering developer engagement and ensuring teams understand secure coding practices and delivery expectations.
 * Application Security Testing: Conduct regular code reviews and application assessments to identify vulnerabilities and guide timely remediation.
 * Governance, Risk, and Compliance: Establish governance frameworks to ensure compliance with internal security policies, industry standards, and regulatory requirements. Monitor, report, and continuously improve the firm's compliance posture.