Application Security Engineer

LinQ Global Group•Philadelphia, PA

20h•Hybrid

About The Position

We are seeking an Application Security Engineer to join our Cyber Defense & Engineering (CDE) team who will be responsible to establish, scale, and own the Application Security operating model across a decentralized product engineering organization undergoing cloud modernization. They will be focused on creating a scalable AppSec capability rather than managing a legacy program. They will design risk-tiering frameworks, integrate automated security gates into CI/CD pipelines, lead threat modeling for cloud migrations, and establish a Security Champions network to embed secure coding practices directly into development teams.

Requirements

Bachelor's degree in Computer Science, Information Security, or equivalent practical experience.
4+ years of combined experience in software engineering, cloud engineering, or application security, including direct hands-on security responsibilities.
Demonstrated capability in executing threat modeling frameworks (STRIDE, PASTA, or equivalent) and translating findings into actionable developer tasks.
Strong technical depth in OWASP Top 10, OWASP ASVS, CWE Top 25, and modern attack patterns against web applications, REST APIs, and microservices.
Experience embedding security tooling into modern CI/CD pipelines (GitHub Actions, Azure DevOps, GitLab CI, Jenkins).
Solid working knowledge of enterprise authentication and authorization standards (OAuth 2.0, OIDC, SAML) and session security.
Familiarity with containerization and cloud-native architecture (Docker, Kubernetes) and their associated security vectors.
Ability to communicate risk and remediation guidance to engineering audiences in language they will accept and act on.

Nice To Haves

Experience configuring and tuning enterprise code scanning platforms (Fortify, Veracode, Wiz Code).
Exposure to Azure/AWS security controls, CSPM, and CNAPP tooling (e.g., Wiz).
Hands-on experience with API security testing, runtime application protection (RASP), and WAF tuning.
Active professional security certifications such as OSCP, OSWE, GWAPT, GPEN, or CISSP.
Familiarity with supply chain security frameworks (SLSA, S2C2F, OpenSSF Scorecard).
Prior work in a distributed, multi-tenant, or franchise-like operational environment.

Responsibilities

Catalog applications, development pipelines, source repositories, and existing security tools across decentralized teams to establish an accurate baseline.
Create and deploy a risk-tiering framework to prioritize security efforts and resources on high-risk applications.
Define, publish, and socialize a minimum application security baseline across engineering leadership regardless of team tooling or SDLC variations.
Build, launch, and lead a Security Champions network across distributed product engineering teams to scale security practices natively.
Lead threat modeling exercises (STRIDE/PASTA) for monolith-to-microservices re-architecture, containerization, and cloud migration projects.
Provide technical architectural guidance during cloud migration decisions to identify security trade-offs before architecture is locked.
Integrate static and dynamic security testing tools seamlessly into CI/CD pipelines (GitHub Actions, Azure DevOps, GitLab CI, Jenkins).
Triage, validate, and prioritize vulnerabilities from automated scanners, penetration tests, bug bounty programs, and detection alerts.
Partner with Security Operations and Incident Response teams on application-layer incidents, analyzing attack paths and exploit feasibility.
Define and track key performance indicators for application coverage, risk tiering, vulnerability density, and remediation velocity.
Evaluate and enforce secure authentication and authorization implementation, including OAuth 2.0, OIDC, SAML, and session management.
Review unfamiliar codebases across diverse languages, configure security scanning engines, and partner with developers to guide remediation.