Application Security Engineer

The Senior Application Security Engineer will operate and mature the application security program by integrating SAST, DAST, and SCA into CI/CD pipelines, managing vulnerabilities, conducting threat modeling and architecture reviews, and guiding secure development. The role includes automating AppSec workflows with LLMs, assessing AI-enabled feature risks, supporting incident response and audits, developing security standards, and reporting risk and remediation metrics while partnering closely with engineering and TechOps. The summary above was generated by AI

Ready to enable the testing and build the workflows required to make the products our customers rely on secure by design? Come join the team protecting a global supply chain technology company and the thousands of customers who depend on it., Reporting to the Senior Director of Information Security, you will be accountable for the tooling, testing coverage, and vulnerability remediation workflow of our application security program. You must be a technical, hands-on practitioner: configuring and operating tools, triaging findings, and partnering directly with developers, while applying AI to achieve scale and speed and actively managing risk. This is an engineering role, not an analyst role. You’ll build and tune the pipeline, not just consume its output. You will be operating, maintaining, and evangelizing our application security program., * Operate the application security program for customer-facing B2B products, working with Engineering and TechOps to embed security by design into planning, development, and release.

• Implement and operate automated security testing (SAST, DAST, and SCA) within CI/CD pipelines, replacing manual practices and driving adoption by software engineering teams.
• Configure and maintain AppSec tooling and the vulnerability management platform, ensuring findings are consistently collected, deduplicated, and tracked across products and repositories.
• Prioritize vulnerabilities based on severity, known exploitation, reachability, and business impact, and drive remediation with Engineering and TechOps to agreed timelines.
• Perform security architecture and design reviews and threat modeling for new products and features, including the API program, so that secure products can launch with repeatable practices.
• Automate and orchestrate AppSec workflows, such as finding triage, remediation guidance, and reporting, using Anthropic Claude API, OpenAI, or equivalent LLM providers, with appropriate validation and guardrails.
• Assess the security of AI-enabled product features and workflows, including risks such as prompt injection, data leakage, and model misuse.
• Develop and maintain secure coding standards and technical guidance for software engineering, and contribute them to the Infosec library of policies, standards, guidelines, and procedures.
• Support data protection for customer-facing products, including encryption, secrets management, and the retirement of weak ciphers and legacy protocols.
• Track product security risks, exceptions, and risk acceptances, and contribute technical input to the Infosec risk register and risk assessments.
• Contribute to incident response for product security events, including investigation, containment support, and post-incident review, and participate in incident simulation exercises.
• Build and report AppSec metrics, including tool coverage, adherence, and remediation timeliness, that feed Infosec KPIs and KRIs and executive reporting.
• Provide technical evidence and subject matter input for audits, customer security assessments, and compliance obligations.
• Support the One TC security culture by coaching developers, delivering secure development guidance, and helping Infosec shift from auditor to advisor.
• Stay current on emerging threats, application security practices, and AI-related security and privacy concerns.

• 5+ years in application and/or product security.
• Hands-on experience implementing and operating SAST, DAST, and SCA tools within CI/CD pipelines.
• Experience triaging and prioritizing vulnerabilities using severity, known exploitation, reachability, and business impact, and driving them to remediation.
• Ability to review code and advise on remediation in .NET/C#.
• Experience performing threat modeling and security architecture and design reviews.
• Working knowledge of secure API design, OAuth/OIDC and JWT handling, secrets management, and encryption fundamentals.
• Strong working knowledge of OWASP Top 10s, ASVS, and Proactive Controls, and the ability to translate findings into business risk.
• Scripting or programming ability (e.g., Python, PowerShell, C#) to automate security workflows and integrate tools via APIs.
• Clear communication with technical and non-technical audiences, and the ability to influence engineering teams without direct authority.
• Preferred: Experience using LLM APIs (e.g., Claude, Copilot) to automate AppSec work such as triage, remediation guidance, or reporting.
• Preferred: Experience assessing AI-enabled features for risks such as prompt injection, data leakage, and model misuse.
• Preferred: Experience with Azure DevOps, DefectDojo, and common open source security scanners.
• Preferred: Experience securing Azure-hosted environments, including IaC, containers, and secrets scanning.
• Preferred: Working knowledge of C++ and Angular.
• Preferred: Manual web and API penetration testing experience, especially for access control and multi-tenant isolation.
• Preferred: Experience in B2B SaaS, multi-tenant platforms, or supply chain/EDI environments.
• Preferred: Experience supporting security incident response.
• Preferred: Experience providing evidence for audits (SOC 2, ISO 27001, PCI) and customer security assessments.
• Preferred: Relevant certifications such as OSWE, GWEB, CSSLP, or AZ-500.

We value our employees with competitive benefits and generous paid time off packages, flexible and casual work environments, career development, recognition programs, and more!, * Remote first and casual work environment

• 401k with 3.5% company match and vested after 2 years
• 20 PTO days - 10 company holidays - 1 birthday day off - 1 Volunteer day - 3 summer days
• Medical, dental, vision and other life/health insurance plans
• Paid parental leave
• Wellness reimbursement program

TrueCommerce is a high-performing global supply chain network that delivers fully integrated, end-to-end supply chain visibility and management. We help some of the world’s leading brands improve supply chain performance, including Schneider Electric, DanoneWave, Siemens, Ocean Spray, and many others.

For additional information, visit our website.

Applicants must be authorized to work for any employer in the U.S. At this time, we are unable to sponsor or take over sponsorship of an employment visa for this role. Equal Opportunity Employer This employer is required to notify all applicants of their rights pursuant to federal employment laws. For further information, please review the Know Your Rights notice from the Department of Labor.