| • The Application Security Engineer is responsible for integrating security into the design, development, testing, and delivery of large-scale Java applications. This role is focused on secure software engineering, application security analysis, vulnerability remediation, and strengthening security practices throughout the SDLC. |
| • The successful candidate should bring prior Java development or architecture experience and be able to work directly with Development and Testing teams on secure coding, code and architecture review, SAST/DAST findings, remediation, and security integration within CI/CD. |
| | | | |
| MINIMUM QUALIFICATIONS |
| • Bachelor's degree in Computer Science, Information Security, Software Engineering, or a related technical field. |
| • 6+ years of combined software Development and/or Application Security experience. |
| • Prior hands-on Java/J2EE development or architecture experience. |
| • Experience supporting security for large-scale, public-facing enterprise applications. |
| • Experience working directly with Development teams to analyze and remediate application vulnerabilities. |
| | | | |
| REQUIRED TECHNICAL / FUNCTIONAL SKILLS |
| • Strong Core Java/J2EE development knowledge and ability to understand application code, frameworks, and architecture. |
| • Application security analysis including secure code review, pull-request review, and/or architecture/design review. |
| • Secure coding practices and common web application vulnerabilities, including OWASP risks. |
| • Hands-on experience analyzing SAST/DAST findings; familiarity with tools such as Fortify on Demand and SonarQube. |
| • Ability to determine whether security-tool findings are relevant, exploitable, false positives, or require remediation. |
| • Experience integrating application security activities into CI/CD and the software development lifecycle. |
| • Experience partnering with Development and Testing teams on remediation, validation, and security testing. |
| • Understanding of authentication, authorization, session management, APIs, cryptography, and SSL/TLS. |
| • Ability to clearly document risk, technical findings, remediation guidance, and validation results. |
| | | | |
| KEY RESPONSIBILITIES |
| • Review Java application code, design, and architecture for security weaknesses and recommend corrective action. |
| • Analyze SAST, DAST, and other application-security findings and work with Development teams to prioritize and remediate issues. |
| • Provide secure coding guidance and practical remediation recommendations to developers. |
| • Partner with Development and Testing teams to integrate security checks and validation into delivery pipelines and test practices. |
| • Validate remediation and help distinguish true vulnerabilities from false positives or non-exploitable findings. |
| • Support secure SDLC practices, application security standards, and continuous improvement activities. |
| • Review application changes, APIs, authentication/authorization patterns, and other security-sensitive functionality. |
| • Monitor relevant Java vulnerabilities, third-party component risks, and published NIST CVEs. |
| • Document findings, risk, remediation guidance, and validation results for technical and non-technical stakeholders. |
| | | | |
| PREFERRED QUALIFICATIONS |
| • Fortify on Demand, SonarQube, or comparable SAST/DAST tooling. |
| • Software Composition Analysis (SCA) and Software Bill of Materials (SBOM) experience. |
| • API security testing and secure design review. |
| • Cloud application security experience. |
| • Relevant application-security certification. |
| • HIPAA or other regulated-environment experience. |
| • AI-assisted application-security tools, with manual validation of findings. |
| | | | |
| CANDIDATE PROFILE |
| • Candidate should clearly explain a current/recent Java application and their individual Application Security responsibilities. |
| • Candidate should provide specific examples of code, architecture, SAST/DAST, or secure-design findings they personally analyzed. |
| • Candidate should explain how they determined whether a finding represented real risk and how they worked with Development on remediation. |
