> Markdown version of [/jobs/ext/628381-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/628381-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Application Security Engineer - **Company:** Awardco, Inc. - **Location:** United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Java (Programming Language), JavaScript (Programming Language), Application Programming Interfaces (APIs), Artificial Intelligence, User Authentication, Automation of Tests, C Sharp (Programming Language), Software as a Service, Static Program Analysis, Data Validation, Dynamic Program Analysis, Github, Python (Programming Language), Local Security Policy, Open Web Application Security, PCI Data Security Standards, Secure Coding, Session Management, Software Engineering, TypeScript, Web Applications, Data Logging, Software Security, GWAPT, Production Code, Static Application Security Testing, Programming Languages, Dynamic Application Security Testing - **Published:** June 24, 2026 - **Apply:** https://www.dice.com/job-detail/9398c4ca-599c-4939-8d56-c76562cca1a1 ## About the Role * 6+ years of experience in application security or in software engineering with a strong security focus for web applications or APIs. * Hands-on experience securing cloud-hosted, multi-tenant SaaS applications on a major public cloud platform. * Strong understanding of web and API security fundamentals (authentication, authorization, session management, data validation, encryption, multi-tenant isolation, etc.). * Deep familiarity with the OWASP Top 10, common vulnerability classes, and practical exploitation/remediation techniques. * Experience with one or more modern programming languages (for example: JavaScript/TypeScript, Java, C#, Python, or Go) and the ability to read and reason about production code. * Hands-on experience with application security tooling, such as Static analysis (SAST), Dynamic analysis (DAST), Dependency and container scanning, and API security testing tools or frameworks. * Experience working with modern and AI-assisted security tooling (e.g., GitHub Advanced Security, Snyk, Wiz, or similar) and integrating them into CI/CD pipelines to improve developer experience and reduce risk. * Solid understanding of CI/CD pipelines and how to integrate security testing into automated workflows. * Ability to translate complex security issues into clear, actionable guidance for engineers and product partners. * Comfortable balancing risk, user experience, and delivery timelines in a fast-moving environment. * Strong ownership mindset and Collaborative, low-ego approach with a focus on building trust and partnership across teams. * Demonstrated ability and desire to train and mentor developers in secure coding best practices, enabling them to confidently build and ship secure features over time. Nice to Have (Bonus Points, Not Requirements) * Experience helping support or respond to external pen tests, bug bounty reports, or coordinated disclosure. * Background working with compliance or regulatory frameworks (e.g., SOC 2, ISO 27001, PCI DSS) from the engineering side. * Relevant security certifications (e.g., OSWE, OSCP, GWAPT, CSSLP) or an equivalent track record of hands-on work. ## Description We're looking for an Application Security Engineer joining our IT & Security team to build and mature our application security program as we continue to scale our SaaS platform. In this role, you'll partner closely with product, engineering, and operations teams to design, build, and ship secure features - without slowing down creativity and innovation. You'll own the secure software development lifecycle, lead security reviews for new capabilities, and help drive a culture where every engineer treats security as part of quality. You'll also play a key role in enabling developers, building the skills and tooling they need to own security in their code through secure coding guidance, training, and a strong Security Champions program. If you enjoy rolling up your sleeves, solving real-world security problems, and making cloud products safer by design, this role is for you. What you will do: * Embed security checkpoints into planning, design, development, testing, and release processes. * Partner with engineering leads to ensure new features ship with security built in, not bolted on. * Facilitate threat modeling for new services, APIs, and integrations. * Recommend secure patterns and architectures for multi-tenant SaaS and cloud-native components. * Perform targeted secure code reviews for high-risk features and components. * Configure and tune SAST, DAST, dependency, and container scanning to reduce noise and highlight real risk. * Integrate and optimize AI-assisted application security tools (e.g., GitHub Advanced Security, Snyk, Wiz, or similar) within developer workflows to improve signal and remediation speed. * Help define and maintain secure coding standards and patterns used across engineering teams. * Triage, prioritize, and track remediation of application and API vulnerabilities across the stack. * Advise on secure use of authentication, authorization, cryptography, and data protection controls. * Help evaluate and integrate third-party services and SDKs from a security perspective. * Provide clear, technical explanations of findings, mitigations, and residual risk. * Build and deliver pragmatic secure coding training tailored to our tech stack and common issues. * Create playbooks, checklists, and self-service guidance for developers to help them ship secure code independently. * Champion a "secure by default" mindset across product and engineering. * Grow and enhance the Security Champions program, mentoring developers to act as local security advocates on their teams. * Assist with investigation and remediation for application-level security incidents. * Help improve detection, logging, and alerting for application and API misuse. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Innovating Developer Tools with AI: Insights from GitHub Next](https://www.wearedevelopers.com/videos/1268-innovating-developer-tools-with-ai-insights-from-github-next) - [Do TypeScript without TypeScript](https://www.wearedevelopers.com/videos/327-do-typescript-without-typescript) - [Software Security 101: Secure Coding Basics](https://www.wearedevelopers.com/videos/220-software-security-101-secure-coding-basics) - [Bringing AI Model Testing and Prompt Management to Your Codebase with GitHub Models](https://www.wearedevelopers.com/videos/1536-bringing-ai-model-testing-and-prompt-management-to-your-codebase-with-github-models) - [Vuejs and TypeScript- Working Together like Peanut Butter and Jelly](https://www.wearedevelopers.com/videos/127-vuejs-and-typescript-working-together-like-peanut-butter-and-jelly) ## Related Articles - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers) - [The 8 Best Code Testing Tools](https://www.wearedevelopers.com/magazine/402-the-8-best-code-testing-tools)