Application Security Engineer (AppSec)

Zenus Bank • San Juan, PR

4d • Onsite

About The Position

The Application Security Engineer (AppSec) is responsible for ensuring the security of applications, APIs, and software components throughout the software development lifecycle. Operating within the SecOps domain and reporting to the Information Security Officer (ISO), the role focuses on secure design, code-level security, vulnerability identification, and controlled offensive testing to ensure applications meet organizational security standards before and after deployment. The role owns application security, rather than cloud platform configuration or CI/CD automation. This position is on-site.

Requirements

• 3+ years of experience in application security, secure software development, or ethical hacking.
• Strong knowledge of secure coding principles and common application vulnerabilities.
• Hands-on experience with SAST, DAST, and SCA tools.
• Experience performing manual application and API penetration testing.
• Familiarity with REST APIs, authentication mechanisms, and authorization models.
• Understanding of CI/CD pipelines from a security testing perspective.
• Strong documentation and vulnerability reporting skills.

Responsibilities

• Perform application security testing, including SAST, SCA, and DAST analysis.
• Execute internal manual penetration testing of applications and APIs quarterly, within approved scope.
• Conduct threat modeling for new applications and significant changes.
• Identify, analyze, and document application-level vulnerabilities and security weaknesses.
• Work directly with development teams to support secure remediation and secure coding practices.
• Define and maintain secure coding standards aligned with OWASP Top 10 and OWASP API Top 10.
• Validate that security findings are properly remediated before release.
• Maintain vulnerability tracking and reporting in Archer or approved systems.
• Support the Information Security Officer during audits and security assessments by providing application security evidence.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed