Application Security Engineer

We are seeking a highly skilled Application Security Engineer to design, implement, and maintain robust security measures across our software applications. In this role, you will collaborate closely with product managers and software developers to embed security into every phase of the development cycle. You will act as both an advisor and an automated tooling expert, helping our engineering organization ship code securely without sacrificing velocity., * Security Assessments & Code Reviews: Perform automated and manual code reviews to detect vulnerabilities, business logic flaws, and injection vectors.

• Threat Modeling: Conduct proactive threat modeling and risk assessments during the design phase to identify architectural flaws before code is written.
• DevSecOps Automation: Implement, configure, and maintain automated security scanning tools (SAST, DAST, and SCA) directly into our CI/CD pipelines.
• Vulnerability Management: Triaging scanner alerts, validating proof-of-concepts, and eliminating false positives.
• Developer Advisory & Training: Work directly with software engineers to guide remediation efforts and provide technical training on defensive coding techniques.
• Incident Response Support: Support security incident teams in investigating, containing, and documenting application-level breaches or zero-day vulnerabilities.

• Experience: 10+ years of experience in software engineering, application security, or a dedicated technical security role.
• Secure Coding: Proficient in reading and understanding application code across modern languages (such as Python, Java, JavaScript, or Go).
• Framework Knowledge: Deep familiarity with common application vulnerabilities and mitigations, specifically the and CWE Top 25.
• Tooling Fluency: Hands-on experience with application security tools such as Burp Suite, OWASP ZAP, SonarQube, Checkmarx, or Snyk.
• Architecture: Firm understanding of cloud services, Web APIs, container security, authentication protocols (OAuth, SAML), and cryptographic fundamentals.
• Soft Skills: Exceptional communication skills to translate complex cryptographic or technical security risks into clear, actionable advice for non-security peers.