Application Security Engineer
Core
Integrate security practices into the software development life cycle to build secure web, mobile, and backend applications.
Role type
Senior IC application security engineer
Builds
Secure software applications and CI/CD pipelines
Domain
Software development and cybersecurity
Required skills
Secure Software Development Life Cycle (SSDLC), secure coding practices, threat modeling, secure design principles, risk assessment, vulnerability management, security architecture, security code reviews, SAST, DAST, IAST, SCA, RASP, mobile application security testing (MAST), API security testing, Burp Suite, OWASP ZAP, Checkmarx, Veracode, Fortify, SonarQube, Snyk, GitHub Advanced Security, Semgrep, Trivy, Nessus, Nmap, Java, Python, C#, JavaScript, TypeScript, Go, PHP, Kotlin, Swift, object-oriented programming, input validation, error handling, OWASP Top 10, SQL injection, XSS, CSRF, SSRF, XXE, IDOR, remote code execution, command injection, clickjacking, Content Security Policy, REST security, GraphQL security, OAuth 2.0, OpenID Connect, JWT, API gateway security, rate limiting, API authentication and authorization
Preferred skills
Penetration testing, cloud-native security, containerized application security, DevSecOps implementation, compliance with industry regulations and security frameworks
Technologies
Burp Suite, OWASP ZAP, Checkmarx, Veracode, Fortify, SonarQube, Snyk, GitHub Advanced Security, Semgrep, Trivy, Nessus, Nmap, Java, Python, C#, JavaScript, TypeScript, Go, PHP, Kotlin, Swift, REST, GraphQL, OAuth 2.0, OpenID Connect, JWT
Responsibilities
Integrate security practices into the software development life cycle. Perform SAST, DAST, and software composition analysis. Review code securely across web, mobile, and backend applications. Identify, assess, and remediate application security vulnerabilities. Conduct threat modeling and security risk assessments. Implement DevSecOps security controls in CI/CD pipelines. Conduct penetration tests and vulnerability assessments. Validate authentication, authorization, session management, and API security. Secure cloud-native and containerized applications. Collaborate with development, DevOps, QA, and infrastructure teams. Develop security standards, guidelines, and best practices. Support compliance with industry regulations and security frameworks.
