Senior Application Security Engineer
Core
Improving security of applications, APIs, cloud services, and software delivery practices through vulnerability management, penetration testing, and security automation.
Role type
Senior hands-on IC application security engineer
Builds
Secure web applications, APIs, services, and CI/CD pipelines
Domain
Insurance technology, cloud security, application security
Required skills
vulnerability management, penetration testing, security automation, SAST/DAST/SCA scanning, WAF policy management, API security, cloud security (AWS, Kubernetes), scripting (Python), secure coding practices
Preferred skills
AI-enabled security tooling, Cloudflare Zero Trust, OSCP certification
Technologies
Snyk, Qualys, Trivy, Dependabot, GitHub Advanced Security, AWS, Kubernetes/EKS, Cloudflare
Responsibilities
Manage external penetration testing program including planning, scoping, vendor engagement, and retesting; Prioritize and close Critical and High CVEs with development squads; Build proactive vulnerability remediation processes using security AI agents; Operate and improve SAST, DAST, SCA, container, secrets, and vulnerability-scanning capabilities; Maintain and improve WAF policies, API security policies, and rate-limiting controls; Support threat modeling, secure design reviews, and incident response; Partner with Compliance to maintain ISO 27001, SOX, and SOC 1/2 evidence
Seniority
Senior, hands-on IC
