Application Security Engineer

H.W. Kaufman Group

1d

About The Position

The Application Security Engineer plays a crucial role in securing our growing portfolio of applications. This role will focus on integrating security best practices into the Software Development Lifecycle (SDLC), ensuring compliance with regulatory requirements, proactively mitigating threats, and collaborating closely with developers to enhance the overall security posture of our applications.
As a subject matter expert in application security, the Application Security Engineer will lead the charge in finding and implementing innovative security solutions while ensuring the organization remains resilient against evolving threats. This individual will work closely with development and IT teams to embed security into application architecture, offer technical guidance to junior team members, and drive the implementation of security initiatives essential for meeting business and compliance needs.

Requirements

• 5+ years of experience in application security, secure software development, and vulnerability management
• Strong knowledge of secure coding practices, OWASP Top 10,OWASP Top 10 for LLMs, MITRE ATLAS, and common security vulnerabilities
• Experience with containerization technologies such as Docker and Kubernetes, the principles of container operation, and their secure interaction
• Experience with security testing tools (e.g., Burp Suite, Fortify, Veracode, or similar)
• Familiarity with DevSecOpsprinciples and integrating security into CI/CD pipelines
• Direct experience with security tools such as vulnerability scanners, intrusion detection systems, and log analysis tools
• Understanding of regulatory frameworks and compliance requirements (e.g., NYDFS, GDPR, SOC 2)
• Ability in scripting and automation using languages such as Python, PowerShell, or Bashand leverage AI driven tools to streamline and enhance security process and workflows

Nice To Haves

• Experience with Black Duck/Polaris with Apex code (Salesforce) is a plus
• Experience with BlackDuck/Polaris and Apex code (Salesforce) is a plus
• Relevant certifications such as Certified DevSecOpsEngineer, CISSP, OWASP certifications, GIAC GWAPT

Responsibilities

• Partner with development teams to embed security best practices across the SDLC, including design, development, and deployment, and providesecure coding guidance
• Conduct threat modeling and security architecture reviews to identifydesign-level risks and implement appropriate security controls
• Identify, assess, and mitigate application vulnerabilities through a combination of automated (SAST/DAST) and manual code reviews, as well as penetration testing, and drive risk-based remediation
• Implement and manage application security tools, including SAST, DAST, Software Composition Analysis (SCA), and other security scanning solutions
• Ensure application security practices align with regulatory standards such as NYDFS, NIST, and OWASP guidelines
• Partner with DevOps, IT, and security teams to integrate security into CI/CD pipelines and engineering workflows
• Design and oversee the implementation of authentication, authorization, and access control mechanisms for APIs and platforms
• Develop and enforce secure usage standards and governance for AI tools and AI-generated code, addressing risks such as prompt injection, data leakage, insecure code generation, and model misuse, while aligning with regulatory and industry standards

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed
• Number of Employees: 101-250 employees