Application Security Engineer

Job Summary

We are seeking a skilled Application Security Engineer to join our Information Security team. The ideal candidate will have a minimum of four (4) years of experience in application security and a strong background in software development, particularly in .NET, C#, Angular, and React. This role is crucial in ensuring the security of our applications by working closely with development, DevOps, and security teams to identify, remediate, and prevent security vulnerabilities throughout the software development lifecycle (SDLC).

Key Responsibilities

• Conduct application security assessments, including code reviews, penetration testing, and threat modeling to identify vulnerabilities.
• Work closely with developers to integrate secure coding practices and provide guidance on remediating security issues.
• Implement and manage Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) tools.
• Develop and enforce security policies, procedures, and best practices for application security.
• Assist in the design and review of security architecture for new and existing applications.
• Collaborate with DevOps teams to integrate security into CI/CD pipelines using DevSecOps principles.
• Research emerging threats, vulnerabilities, and security trends to proactively mitigate risks.
• Support incident response efforts related to application security breaches.
• Provide security training and awareness to development teams.
• Document security findings, mitigation plans, and security controls.

Minimum Requirements (Must-Have)

• 4+ years of experience in application security with a focus on secure software development.
• Strong background in software development, with hands-on experience in .NET, C#, Angular, and React.
• Hands-on experience with SAST, DAST, Software Composition Analysis (SCA), and penetration testing tools (e.g., Burp Suite, Checkmarx, Veracode, Fortify, SonarQube).
• Solid understanding of OWASP Top 10, SANS 25, and secure coding practices.
• Experience with threat modeling, risk assessment, and vulnerability management.
• Knowledge of API security, authentication, and authorization mechanisms (OAuth, JWT, SAML, etc.).
• Familiarity with container security, Kubernetes security, and cloud security best practices (AWS, Azure, GCP).
• Experience working in Agile and DevSecOps environments, integrating security into CI/CD pipelines.
• Strong analytical and problem-solving skills.

Excellent communication skills, with the ability to work collaboratively across teams.