Application Security Engineer

Job Tittle : Application Security Engineer
Exp : 11 years
Visa : and USC
Remote
Job Type : W2

• Security Assessments & Code Reviews: Perform automated and manual code reviews to detect vulnerabilities, business logic flaws, and injection vectors.
• Threat Modeling: Conduct proactive threat modeling and risk assessments during the design phase to identify architectural flaws before code is written.
• DevSecOps Automation: Implement, configure, and maintain automated security scanning tools (SAST, DAST, and SCA) directly into our CI/CD pipelines.
• Vulnerability Management: Triaging scanner alerts, validating proof-of-concepts, and eliminating false positives. 
• Developer Advisory & Training: Work directly with software engineers to guide remediation efforts and provide technical training on defensive coding techniques.
• Incident Response Support: Support security incident teams in investigating, containing, and documenting application-level breaches or zero-day vulnerabilities.

• Experience: 10+ years of experience in software engineering, application security, or a dedicated technical security role.
• Secure Coding: Proficient in reading and understanding application code across modern languages (such as Python, Java, JavaScript, or Go).
• Framework Knowledge: Deep familiarity with common application vulnerabilities and mitigations, specifically the and CWE Top 25.
• Tooling Fluency: Hands-on experience with application security tools such as Burp Suite, OWASP ZAP, SonarQube, Checkmarx, or Snyk.
• Architecture: Firm understanding of cloud services, Web APIs, container security, authentication protocols (OAuth, SAML), and cryptographic fundamentals.
• Soft Skills: Exceptional communication skills to translate complex cryptographic or technical security risks into clear, actionable advice for non-security peers.