Application Security Technical Lead (Remote)

Kforce’s client is seeking an Application Security Remediation Technical Lead to provide technical leadership across three teams supporting a large-scale application security initiative., * Lead technical direction across two application security remediation teams and serve as the escalation point for complex vulnerabilities, architecture issues, dependencies, and release constraints

• Partner with security, engineering, application, and product to prioritize vulnerabilities based on risk, exposure, business impact, dependencies, and release readiness
• Establish remediation standards for secure coding, code reviews, testing, CI/CD controls, releases, and vulnerability closure
• Analyze findings within the broader application architecture to identify dependencies and determine appropriate remediation strategies
• Use AI-assisted engineering tools to analyze code, understand legacy dependencies, recommend fixes, generate tests, and prepare changes for human review
• Guide unit, functional, regression, and security testing to ensure fixes address vulnerabilities without impacting expected functionality
• Ensure findings are not closed until code review, validation, testing, release confirmation, and supporting evidence are complete
• Develop reusable secure coding patterns, remediation approaches, and AI-enabled resources to improve consistency and efficiency
• Identify cross-team risks, dependencies, blockers, and capacity constraints while communicating progress and recommendations to technical and executive stakeholders
• Mentor technical leads and establish repeatable processes that enable teams to operate independently

• 10+ years of software engineering experience, including 5+ years leading application security remediation, secure modernization, or multiple engineering workstreams
• Deep Microsoft-stack experience, including .NET Framework/modern .NET, C#, ASP.NET MVC/ASPX/Razor, REST APIs, SQL Server, T-SQL/stored procedures, Git, and Azure DevOps
• Hands-on application security remediation experience, including OWASP Top 10 and CWE/CVE-based findings
• Experience with SAST, DAST, software composition analysis (SCA), secure SDLC, DevSecOps, and CI/CD security controls
• Ability to analyze application architecture and dependencies to determine upstream/downstream impacts of vulnerabilities and proposed fixes
• Practical experience applying AI to software engineering, including context/prompt design, output validation, governed tool usage, and human review of AI-generated recommendations or code
• Understanding of security/privacy considerations when using AI tools with sensitive data, including PHI, PII, credentials, and secrets
• Ability to make sound technical decisions when scanner findings, AI recommendations, application context, and operational requirements conflict
• Strong communication skills with the ability to explain technical risk, remediation decisions, progress, trade-offs, and capacity needs to technical and non-technical stakeholders

Preferred Qualifications:

• Experience with legacy Microsoft technologies such as Classic ASP, VBScript, VB6/VB.NET, older .NET frameworks, large .NET monoliths, and SQL-heavy applications
• Exposure to legacy modernization, cloud-ready/12-factor architecture, Angular or modern front-end development, and distributed onshore/nearshore/offshore teams
• Healthcare or regulated-industry experience, including HIPAA, and familiarity with SAFe/Agile environments are preferred

The pay range is the lowest to highest compensation we reasonably in good faith believe we would pay at posting for this role. We may ultimately pay more or less than this range. Employee pay is based on factors like relevant education, qualifications, certifications, experience, skills, seniority, location, performance, union contract and business needs. This range may be modified in the future.

We offer comprehensive benefits including medical/dental/vision insurance, HSA, FSA, 401(k), and life, disability & ADD insurance to eligible employees. Salaried personnel receive paid time off. Hourly employees are not eligible for paid time off unless required by law. Hourly employees on a Service Contract Act project are eligible for paid sick leave.

Note: Pay is not considered compensation until it is earned, vested and determinable. The amount and availability of any compensation remains in Kforce’s sole discretion unless and until paid and may be modified in its discretion consistent with the law.

By clicking ?Apply Today? you agree to receive calls, AI-generated calls, text messages or emails from Kforce and its affiliates, and service providers. Note that if you choose to communicate with Kforce via text messaging the frequency may vary, and message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You will always have the right to cease communicating via text by using key words such as STOP.