Senior Application Security Engineer
Core
Run and tune application security scanning tools (SAST, DAST, SCA, secrets, IaC), design security integrations in CI/CD pipelines, and partner with development teams on secure coding and remediation.
Role type
Senior Application Security Engineer (DevSecOps)
Builds
Secure CI/CD pipelines, containerized microservices, and cloud-native infrastructure with embedded security controls.
Domain
Application Security / DevSecOps / Cloud Security
Required skills
Application Security (AppSec), Web Penetration Testing, DevSecOps, SAST/DAST/SCA tooling, CI/CD security integrations, Threat Modeling, Secure Coding, SBOM generation, Container Security, Cloud Security (AWS/Azure/GCP), Source Code Review (JavaScript/TypeScript/Python/Java/C#/Go/PHP/C/C++)
Preferred skills
Agentic AI workflows, Security Automation, SLSA, Sigstore, IaC security scanning, AppSec maturity frameworks (OWASP SAMM, BSIMM, NIST SSDF)
Technologies
Burp Suite Pro, Python, Bash, PowerShell, Git, AWS, Azure, GCP, Docker, Kubernetes
Responsibilities
Run and tune client SAST, DAST, SCA, secrets, and IaC scanning tools; Design and implement security integrations across CI/CD pipelines; Partner with development teams on remediation and secure coding; Assess software supply chain controls; Perform threat modeling and security architecture reviews; Create client-ready deliverables and present findings to technical and executive audiences.
Seniority
Senior, hands-on IC