Application Security Engineer 2
Core
Designing and executing application security (AppSec) and DevSecOps maturity models, capability assessments, and strategic roadmaps for client organizations.
Role type
Senior AppSec Program Consultant / Strategy Lead
Builds
Strategic AppSec program roadmaps, maturity assessments, and executive-level security governance frameworks
Domain
Application Security / DevSecOps / Software Supply Chain Risk Management
Deliverable
dashboards & analysis
Required skills
AppSec program maturity modeling, capability assessment, SBOM standards (SPDX, CycloneDX), OSS vulnerability remediation, SDLC security controls, CI/CD pipeline security, executive communication, strategic planning
Preferred skills
Big Four or boutique AppSec consultancy experience, Software Supply Chain Risk Management (SSCRM), AI/ML assurance, DevSecOps pipeline design, software development background (Java, Python, C#), industry certifications (CEH, CISSP, CSSLP, CISM)
Technologies
SPDX, CycloneDX, BSIMM, NIST SSDF, OWASP SAMM
Responsibilities
Develop multi-year AppSec or DevSecOps roadmaps, execute maturity models and capability assessments, translate technical findings into executive narratives, facilitate client-facing security strategy sessions
Seniority
Mid-Senior, hands-on strategy & consulting
