DevSecOps / Application Security Engineer

Position: DevSecOps / Application Security Engineer

Location: Remote

Hiring Mode: 3+ Months Contract

Job Description:

Client is seeking an experienced DevSecOps / Application Security Engineer to support an enterprise customer responding to critical PHP vulnerabilities. The immediate focus is finding where PHP actually runs, including inside vendor appliances and third-party applications that may not appear in a standard inventory; applying and validating patches; putting interim mitigations and compensating controls in place where patching has to wait; and checking systems that were exposed before patching for signs of compromise. The consultant will provide additional hands-on capacity to deploy patches and will work closely with application development, infrastructure, and security teams. Hands-on experience with GitHub and GitLab is also needed to review PHP applications, dependencies, and pipelines in a fast-paced environment with urgent security and patching requirements.

Responsibilities:

• Find where PHP actually runs across the environment, including inside vendor appliances, commercial and third-party applications, containers, and bundled copies that may not appear in a standard asset inventory. Confirm the PHP version that is actually serving requests, not only what is installed.
• This role is primarily focused on patching. Provide additional capacity to deploy PHP and related application patches, coordinate with infrastructure, platform, and vendor teams that own deployment, track patching work through completion, and validate that each fix has addressed the identified risk (for example, restarting or redeploying workers and rescanning).
• Where patching has to wait (vendor-dependent fixes, change windows, unsupported versions), design, implement, and document interim mitigations and compensating controls such as configuration hardening, WAF rules, access restrictions, and network isolation. Track these exceptions and close them out when patches become available.
• Check systems that were exposed before patching for signs of compromise, such as log review, indicators of compromise, and unexpected files, processes, or credentials. Escalate findings to security operations and incident response teams and support containment and follow-up.
• Identify and prioritize vulnerabilities based on internet exposure, exploitability, and business criticality, and own application and software-development-environment remediation through completion.
• Review GitHub and GitLab repositories, dependencies, libraries, and application components for security risks, with emphasis on PHP applications and PHP dependencies.
• Integrate and improve security controls and scanning within CI/CD pipelines, including checks that catch vulnerable PHP versions and dependencies before release.
• Partner with application development, infrastructure, and cybersecurity teams to coordinate remediation activities.
• Assist with response and remediation for critical or newly disclosed vulnerabilities, and provide technical guidance on patching, vulnerability management, and risk reduction.
• Support static and dynamic application security testing, software composition analysis, dependency scanning, and secrets scanning, and help reinforce secure coding and DevSecOps practices.

Qualifications:

• Hands-on experience in DevSecOps, application security, product security, or security engineering, with a focus on vulnerability remediation.
• Hands-on experience with PHP application environments (for example PHP-FPM, Apache mod_php, php-cgi, or Nginx), including identifying versions, applying updates, and validating fixes.
• Experience locating software and runtimes that fall outside standard inventories, such as vendor appliances, commercial and third-party applications, and containers, using vulnerability scanners, asset discovery, or software inventory tools.
• Experience implementing interim mitigations and compensating controls (configuration hardening, WAF rules, access restrictions, segmentation) when patching cannot be done immediately.
• Experience reviewing exposed systems for signs of compromise, including log analysis and indicator-of-compromise checks, and working with security operations or incident response teams.
• Strong understanding of vulnerability management, patching, remediation, and risk prioritization, with experience responding to critical or zero-day vulnerabilities.
• Strong working experience with GitHub and GitLab in enterprise software development environments.
• Experience securing CI/CD pipelines and integrating security testing into development workflows.
• Knowledge of SAST, DAST, software composition analysis, dependency scanning, secrets scanning, secure coding practices, and OWASP principles.
• Ability to work effectively across development, infrastructure, and cybersecurity teams.
• Ability to operate with urgency and independently drive remediation work in a fast-paced enterprise environment.
• Preferred certifications include GIAC Certified Incident Handler (GCIH), GitHub Advanced Security (GH-500), GIAC Cloud Security Automation (GCSA), GIAC Web Application Penetration Tester (GWAPT), GIAC Certified Web Application Defender (GWEB), Offensive Security Web Expert (OSWE), or comparable credentials.

Tools and Technologies:

• PHP runtimes and web servers (PHP-FPM, Apache, Nginx) and PHP application environments
• Vulnerability scanning and asset discovery tools such as Qualys, Tenable, Rapid7, Wiz, or comparable
• Patch deployment and configuration management tools such as Ansible, AWS Systems Manager, SCCM, or comparable
• WAF and compensating-control tooling
• Logging, SIEM, and EDR tools for compromise assessment such as Splunk, Microsoft Sentinel, CrowdStrike, or comparable
• GitHub and GitHub Advanced Security; GitLab and GitLab security capabilities
• CI/CD pipelines and DevSecOps tooling
• SAST, DAST, software composition analysis, dependency scanning, and secrets scanning tools (Snyk, Veracode, Checkmarx, SonarQube, Black Duck, Mend, or comparable)
• OWASP application security standards and guidance