Application Engineer / DevSecOps
Core
Hands-on application security engineer assessing web applications, APIs, and cloud environments for vulnerabilities and providing remediation guidance.
Role type
Senior IC application security engineer (DevSecOps)
Builds
Secure web applications and APIs integrated into development workflows
Domain
Application security, API security, Cloud security (AWS)
Required skills
Manual application security testing, API security testing, AWS security (IAM, S3, Lambda, API Gateway), SAST/DAST tuning, secure code review, threat modeling, vulnerability management, remediation guidance
Preferred skills
GraphQL security, security automation/SOAR, threat modeling, offensive security testing, security certifications
Technologies
Burp Suite, Wiz, Qualys, Snyk, SonarQube, AWS, Java, Python, JavaScript/TypeScript, Go, REST, GraphQL
Responsibilities
Investigate and validate vulnerabilities from automated tools and penetration tests; Test applications and APIs focusing on authentication, authorization, injection, and business logic; Conduct secure code reviews and contribute to threat modeling; Manage and tune SAST and DAST capabilities; Assess AWS security configurations and cloud-to-application attack paths; Track remediation and report security posture to leadership.
Seniority
Senior, hands-on IC
