Application Security Engineer

VSG Business Solutions•San Francisco, NY

About The Position

The Application Security Engineer is a hands-on software security professional responsible for integrating security throughout the software development lifecycle. The role focuses on securing custom applications, APIs, dependencies, containerized workloads, and CI/CD pipelines while partnering with development, platform, cybersecurity, and risk teams. The engineer identifies, prioritizes, and remediates application-layer risks, implements scalable controls, and helps establish a durable application security operating capability that can be transferred to permanent staff. The position requires 7–10 years of experience for mid-level candidates and 10–15 years for senior-level candidates. A strong combination of software engineering, application security, automation, DevSecOps, and security-program execution is required. Experience in regulated, high-availability, or business-critical environments is highly desirable.

Requirements

Hands-on experience developing, reviewing, testing, and remediating application code in modern software environments.
Experience identifying and mitigating vulnerabilities in applications, APIs, open-source dependencies, container images, frameworks, runtimes, and software supply chains.
Strong understanding of secure software design, secure coding practices, threat modeling, and common application security risks.
Experience embedding security controls and approval criteria into source-control, pull-request, build, test, release, and deployment workflows.
Practical experience with SAST, software composition analysis, secrets detection, dependency management, container scanning, and vulnerability-management platforms.
Experience validating findings, assessing exploitability and business impact, reducing false positives, and defining risk-based remediation SLAs.
Experience securing containerized and cloud-native applications, including Docker, Kubernetes, registries, base images, and policy-as-code controls.
Strong scripting and automation experience using Python, PowerShell, Bash, or a comparable language.
Experience operating vulnerability remediation, exception, and risk-acceptance processes, including compensating controls, ownership, expiration, and escalation.
Strong communication, problem-solving, and cross-functional leadership skills, with the ability to take ownership from discovery and baseline through implementation, stabilization, documentation, and knowledge transfer.
Strong software development skills in one or more modern programming languages.
Deep understanding of application architecture, web applications, APIs, microservices, authentication, authorization, secrets management, and secure coding principles.
Experience with Git, GitHub, Jenkins, GitOps workflows, and modern CI/CD platforms.
Experience with Docker, Kubernetes, container registries, and policy-as-code frameworks.
Understanding of software supply-chain security, dependency and base-image lifecycle management, artifact integrity, and end-of-life technology risk.
Ability to perform root-cause analysis and establish ownership across code, dependencies, containers, pipelines, platforms, and infrastructure boundaries.
Ability to translate technical risk into prioritized roadmaps, measurable controls, operational reporting, and clear communication for engineering and leadership audiences.
Bachelor's degree in computer science, software engineering, cybersecurity, information systems, or equivalent professional experience.
Demonstrable use of AI-assisted engineering tools such as GitHub Copilot with appropriate validation and secure-development practices.

Nice To Haves

C# and .NET experience.
Familiarity with Flux.
Experience with tools such as Aikido, SonarQube, Gitleaks, Trivy, Renovate, or equivalent application security technologies.
Familiarity with cloud application security and cloud-native delivery patterns; AWS experience is a plus.
Experience in regulated, high-availability, or business-critical environments is highly desirable.

Responsibilities

Inventory and baseline in-scope applications, repositories, dependencies, container images, delivery pipelines, security-tool coverage, and end-of-life frameworks and runtimes; identify unmanaged or unscanned assets.
Partner with development teams to identify, prioritize, and remediate vulnerabilities in code, APIs, dependencies, container images, and application configurations.
Perform secure code reviews, architecture and design reviews, and application security assessments throughout the software development lifecycle.
Write, review, test, and submit application-code and pipeline-configuration changes required to resolve security issues.
Define, implement, and maintain risk-based security gates, approval criteria, automated controls, and controlled bypass processes across source-control and CI/CD workflows.
Configure and tune application security tooling to improve coverage, accuracy, maintainability, developer usability, and false-positive rates; recommend whether tools should be retained or retired.
Establish secure development standards, remediation SLAs, finding-routing rules, and an application-security exception register with compensating controls, owners, expiration dates, and escalation paths.
Develop automation for repository and pipeline coverage monitoring, finding intake, triage, ownership assignment, overdue remediation, failed gates, expired exceptions, reporting, and escalation.
Support container and Kubernetes security through dependency and base-image currency practices, image governance, workload controls, and policy-as-code enforcement.
Define, track, and report application security KPIs, including scanner coverage, remediation performance, gate effectiveness, backlog and exception aging, and end-of-life technology risk; create runbooks, operating documentation, training, and knowledge transfer materials.