Senior Application Security Engineer

The Application Security Engineer is responsible for integrating security throughout the software development lifecycle to reduce risk and improve the security of PowerSchool’s products and services. Reporting to the Senior Manager of Product Security, this role partners closely with engineering, architecture, product, and DevOps teams to identify security requirements, perform threat modeling, conduct secure design reviews, manage application security testing programs, and guide remediation efforts. The Application Security Engineer serves as a trusted advisor to development teams, helping ensure that security is built into applications from design through deployment while supporting secure development practices, developer education, and continuous improvement of the organization’s product security program., As an application security engineer, you are responsible for identifying potential threats and vulnerabilities in applications, designing secure software systems, and implementing robust security measures. Your day-to-day job will consist of:

• Partner with development, architecture, product, and DevOps teams to integrate security throughout the software development lifecycle.
• Perform threat modeling exercises to identify potential attack vectors, security risks, and required security controls for new and existing applications.
• Conduct secure architecture and design reviews to identify security weaknesses and recommend effective mitigations early in the development process.
• Provide security guidance and consultation to engineering teams regarding secure coding practices, application security risks, and security requirements.
• Manage and support application security testing programs, including static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), secret scanning, and related security technologies.
• Analyze, validate, prioritize, and communicate application security findings to development teams and other stakeholders.
• Work with engineering teams to develop remediation plans and track security issues through resolution.
• Establish, maintain, and continuously improve application security standards, secure coding requirements, and secure development lifecycle processes.
• Evaluate third-party software components, open-source dependencies, and software supply chain risks to identify potential security concerns.
• Support software bill of materials (SBOM) initiatives and software supply chain security activities.
• Develop security requirements, security patterns, and implementation guidance for web applications, APIs, cloud-native applications, and supporting services.
• Collaborate with Offensive Security Engineers to review penetration test findings and drive corrective actions where appropriate.
• Design and deliver application security training, awareness materials, and developer enablement programs.
• Support security champions and other security advocate programs within engineering organizations.

Applications Security, Software Engineering, Ecosystems, Cloud Computing, Software Administration, Threat Modeling, Test Program, Applications Security, Continuous Improvement, Risk Management, * 5+ years of experience in application security, software security, secure software development, DevSecOps, software engineering, or a related discipline.

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Software Engineering, or a related field; or equivalent combination of education, training, and experience.
• Experience performing threat modeling, secure design reviews, and application security assessments.
• Experience identifying and mitigating common web application and API vulnerabilities, including those described by the OWASP Top 10 and OWASP API Security Top 10.
• Experience supporting application security testing technologies, including SAST, DAST, SCA, secret scanning, and related security tooling.
• Strong understanding of secure coding principles, software architecture, and secure development practices.
• Knowledge of authentication, authorization, session management, cryptography, API security, and software supply chain security concepts.
• Experience working with software development teams to remediate security findings and implement secure solutions.
• Familiarity with modern software development methodologies, CI/CD pipelines, and DevOps practices.
• Knowledge of cloud technologies and security concepts within AWS and/or Microsoft Azure environments.
• Strong analytical, communication, presentation, and stakeholder management skills.
• Ability to communicate technical security concepts effectively to developers, engineers, and business stakeholders., * Experience working within a SaaS, cloud-native, software development, or technology organization.
• Experience serving as an application security engineer within a mature Product Security or DevSecOps program.
• Experience with software development languages such as Java, C#, JavaScript, TypeScript, Python, Go, or similar technologies.
• Experience developing secure development lifecycle (SDLC) processes, standards, and governance frameworks.
• Experience conducting manual secure code reviews and identifying security weaknesses in application source code.
• Experience supporting software supply chain security initiatives, including SBOM generation, dependency management, and open-source risk management.
• Experience with container security, Kubernetes security, cloud-native application security, and API security.
• Familiarity with threat intelligence, penetration testing, offensive security practices, and vulnerability management programs.
• Experience implementing or supporting security champions programs and developer security training initiatives.
• Familiarity with NIST Secure Software Development Framework (SSDF), OWASP SAMM, or similar software security frameworks.
• Industry certifications such as CISSP, CSSLP, GWAPT, GWEB, OSWE, Security+, Azure Security Engineer Associate, AWS Security Specialty, or equivalent.

Along with our highly market competitive base compensation, PowerSchool offers the following benefits:

• Comprehensive Insurance Coverage (including Medical, Dental, Vision, Pharmacy benefits, Life Insurance and AD&D)
• Flexible Spending Accounts and Health Savings Accounts
• Short-Term Disability and Long-Term Disability
• Comprehensive 401(k) plan
• Generous Parental Leave
• Unrestricted paid time off (known as Discretionary Time Off - DTO)
• Wellness Program, including ClassPass & Employee Assistance Program
• Tuition Reimbursement
• Optional Benefits: Pet Insurance, Identity Theft Protection, Student Debt Repayment Program and Prepaid Legal coverage

EEO Commitment

At PowerSchool, we power education for students around the world. As the global leader in cloud-based K-12 software, we support the full education ecosystem-from the central office to the classroom to the home. Joining PowerSchool means being part of a mission-driven team that is transforming K-12 education by helping schools operate more effectively and deliver better outcomes for educators, students, and families.