> Markdown version of [/jobs/ext/643925-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/643925-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Application Security Engineer

- **Company:** Centerfield Media
- **Location:** Los Angeles, CA, United States (Remote available)
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** .NET Framework, PHP (Programming Language), Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, C Sharp (Programming Language), Cloud Computing, Cloud Computing Security, Cyber Security, Continuous Integration, Information Leak Prevention, DevOps, Github, Information Security Management, Python (Programming Language), Node.Js, PCI Data Security Standards, Systems Development Life Cycle, Next.js, Secure Coding, Web Application Security, Software Engineering, SonarQube, Software Vulnerability Management, AI Infrastructure, Scripting, Google Cloud, Large Language Models, Software Security, GWAPT, Kubernetes, AWS Fargate, Jenkins, Static Application Security Testing, Dynamic Application Security Testing
- **Published:** June 25, 2026
- **Apply:** https://www.dice.com/job-detail/5971d350-e3d2-4ad8-a670-169b790e7076

## About the Role

* 7+ years of experience in software engineering and/or application security, with meaningful ownership of an AppSec program or function.
 * Strong understanding of modern web application security, common attack patterns, and secure design principles.
 * Experience building security into CI/CD and developer workflows, including SAST, DAST, SCA, Secrets scanning, Container and/or IaC scanning.
 * Hands-on experience working with multiple stacks such as Node/Next.js, C#/.NET, Python, and PHP.
 * Practical cloud and platform understanding (Centerfield is primarily AWS with some Google Cloud Platform), including how modern apps run on Kubernetes/EKS and ECS/Fargate.
 * Strong communication skills and ability to explain security tradeoffs to both technical and non-technical audiences.
 * Proven ability to lead cross-team initiatives, set standards, and drive adoption in environments with varied tooling and legacy constraints.
 * Familiarity with compliance-driven environments and ability to translate requirements into engineering-friendly controls (SOC 2, HIPAA and/or PCI-DSS).

Bonus Points...

 * Experience with cloud security tooling and posture management tools: Jenkins. GitHub, Mend.io, SonarQube, Wiz.io.
 * Experience building Security Champions programs and scalable developer education.
 * Experience with threat modeling methodologies and running design review programs.
 * Familiarity with bug bounty, responsible disclosure, and coordinated vulnerability disclosure processes.
 * Experience supporting regulated production environments with clear separation of scopes (e.g., PCI vs. non-PCI).
 * Relevant certifications (e.g., CSSLP, GWAPT, GWEB, OSWE, AWS Security Specialty) or equivalent demonstrated expertise.

## Description

* Establish a consistent AppSec operating model across engineering teams (intake, triage, remediation, exceptions, reporting).
 * Increase coverage and signal quality for SAST, SCA, secrets scanning, and DAST across CI/CD.
 * Improve mean-time-to-remediate for critical findings and reduce repeat vulnerabilities through root-cause fixes.
 * Make threat modeling and design reviews a standard part of delivering new capabilities.

How You'll Contribute...

 * Build and run the AppSec program: Define standards, workflows, and SLAs for identifying, prioritizing, and remediating application vulnerabilities.
 * Embed security into the SDLC: Integrate security checks into build and deployment pipelines (e.g., GitHub/Jenkins) and make results actionable for engineering teams.
 * Security testing at scale: Operate and tune AppSec tooling for SAST, DAST, and SCA, and ensure teams can consistently scan code and dependencies.
 * Threat modeling & design reviews: Lead threat modeling sessions and architecture reviews for new services and major changes to identify risks early.
 * Secure code reviews: Partner with engineering to review high-risk changes and coach teams on secure coding patterns.
 * AI security testing: Design and execute security testing for AI infrastructure and workflows, including access controls for AI agents and LLM-focused vulnerability testing (e.g., hallucination and misinformation risks, data leakage and exfiltration, prompt injection, jailbreaks, and toxicity or abuse content generation).
 * Vulnerability management: Own the end-to-end lifecycle including intake, triage, prioritization, remediation guidance, verification, and root cause analysis.
 * Tooling & automation: Manage and continuously improve AppSec tools and workflows (e.g., Mend.io, SonarQube, and related ecosystem). Use scripting and APIs (Python preferred) to automate repetitive tasks and reporting.
 * Developer enablement: Create lightweight training, office hours, and a Security Champions model that scales across teams.
 * Cross-functional partnership: Work closely with Software Engineering, DevOps, Security, and Security Operations to align detection, response, and hardening efforts., * This is ideally a hybrid position, and employees are expected to work in our Playa Vista, CA office every Tuesday, Wednesday & Thursday
 * Competitive salary + semi-annual bonus
 * Unlimited PTO - take a break when you need it!Industry-leading medical, dental, and vision plans + generous parental leave
 * 401(k) company match plan - fully vested on day 1
 * Outside patio overlooking Playa Vista + cabanas, firepits & working grills
 * Monthly happy hours, catered lunches + daily food trucks
 * Award-winning culture & unprecedented team spirit (featured in LA Business Journal & Built In LA)Fully stocked kitchens with snacks & drinks
 * Breakroom supplied with games, couches, workout equipment + weekly in-office exercise classes hosted by professional instructors (yoga, kickboxing & circuit training)
 * Free onsite gym + locker rooms
 * Paid charity and volunteer days (local mentor programs, adopt a pet, beach cleanup, etc.)
 * Monthly team outings (ball games, casino night, hikes, etc.)
 * Career growth - we enjoy promoting from within!

#LI-CC1
#LI-Remote

AI & Interview Policy

At Centerfield, we use AI tools internally to support efficiency and fairness in our hiring process, including resume screening and administrative tasks.

Candidates are welcome to use AI tools ethically to prepare for interviews, such as practicing responses or researching questions. However, all responses during the interview process should reflect your own knowledge, experience, and judgment.

The use of AI tools to generate responses during live interviews, technical assessments, or written submissions is not permitted unless explicitly stated otherwise.


## Related Videos

- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [From DevOps to Scaled DevOps: How We’re Rebuilding Continuous Delivery as a Platform](https://www.wearedevelopers.com/videos/100018-from-devops-to-scaled-devops-how-we-re-rebuilding-continuous-delivery-as-a-platform)
- [Innovating Developer Tools with AI: Insights from GitHub Next](https://www.wearedevelopers.com/videos/1268-innovating-developer-tools-with-ai-insights-from-github-next)
- [Real-World Security for Busy Developers](https://www.wearedevelopers.com/videos/1545-real-world-security-for-busy-developers)
- [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see)
- [DevOps Maturity Check – a way to balance autonomy and alignment](https://www.wearedevelopers.com/videos/58-devops-maturity-check-a-way-to-balance-autonomy-and-alignment)

## Related Articles

- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Dev Digest 121 - AI goes offline](https://www.wearedevelopers.com/magazine/456-dev-digest-121-ai-goes-offline)
- [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers)