Lead Cybersecurity - Application Security Engineer - Dynamic, Runtime & API Security

AT&T•Middletown Township, NJ

1d•$141,300 - $237,400•Onsite

About The Position

This position requires office presence of a minimum of 5 days per week and is only located in the location(s) posted. No relocation is offered. Join AT&T and reimagine the communications and technologies that connect the world. Our Chief Security Office ensures that our assets are safeguarded through truthful transparency, enforce accountability and master cybersecurity to stay ahead of threats. Bring your bold ideas and fearless risk-taking to redefine connectivity and transform how the world shares stories and experiences that matter. When you step into a career with AT&T, you won’t just imagine the future-you’ll create it. We are seeking an Application Security Engineer to strengthen the security of our applications and APIs through a combination of dynamic application security testing (DAST), runtime application self-protection (RASP), and API security engineering. This is an application security engineering role, not a traditional security operations position. The ideal candidate is a security-minded engineer with strong hands-on experience in web application and API security, who understands modern application attacks and can translate that understanding into practical testing, protection, and remediation strategies. This role sits at the intersection of AppSec engineering and production defense, with responsibility for identifying exploitable vulnerabilities both before deployment and while applications are running in production, reducing risk from active attacks, misuse, and exposed application behavior. This candidate will also evaluate and implement AI-assisted security capabilities to improve coverage, prioritization, and speed — such as intelligent scan orchestration, alert triage, anomaly detection for API abuse, and developer-facing remediation guidance — while ensuring results are valid, measurable, explainable, and safe for production use. Job Summary: You will own and scale dynamic security capabilities across the Software Delivery Lifecycle (SDLC) and production, with a strong emphasis on: DAST automation and integration into CI/CD pipelines RASP and in-process runtime protection (e.g., JVM/.NET CLR instrumentation) API Security engineering for internal and external/internet-facing endpoints, including edge/API gateway protections and continuous API discovery (shadow/zombie APIs) This role is best suited for a candidate with an application security mindset first: someone who can assess real-world exploitability, validate findings, work directly with developers on durable remediation, and build or extend automation in code when existing tooling does not fully solve the problem. You’ll partner closely with security teams, platform teams, and developers to define policy, deploy controls safely, tune security tool detections, reduce false positives, and measurably improve security outcomes. Detailed Job Description: This role focuses on active defense for web applications and APIs through a combination of security testing, runtime instrumentation, and API protection. The candidate will help design and mature security programs that combine: Dynamic application and API testing to identify exploitable vulnerabilities, logic weaknesses, and misconfigurations as early as possible Runtime protection and instrumentation via runtime security principals and tools such as RASP to detect and, where appropriate, block exploit attempts in production, with an emphasis on protecting API traffic, application workflows, and business logic API security capabilities such as API gateway onboarding and policy enforcement, abuse prevention (e.g., scraping/bots), technical reviews and deep-dives, and continuous discovery of undocumented, unmanaged, or exposed APIs Success in this role requires deep application security knowledge — including web and API attack patterns, authentication and authorization weaknesses, exploitability analysis, and vulnerability remediation — as well as ability to script, automate, integrate, and build lightweight solutions when commercial tooling is insufficient. The right candidate will be comfortable moving between hands-on security testing, technical analysis, developer partnership, and security engineering automation, with a focus on reducing meaningful application risk. Key Responsibilities: AI-Assisted Security Engineering Identify practical opportunities to apply AI-assisted approaches across DAST, API testing, runtime telemetry, and security workflows (e.g., prioritization, correlation, anomaly detection, automated enrichment, and remediation support). Implement AI-enabled workflows to reduce false positives, improve triage efficiency, and accelerate remediation (e.g., intelligent deduplication, exploitability scoring, and auto-generated developer guidance with human review). Partner with platform and engineering teams to integrate AI-assisted and automated security capabilities into pipelines and operational processes in a measurable, repeatable, and secure way. DAST & Dynamic Testing (Scale and Automation) Own the DAST lifecycle, including onboarding, authenticated scanning, scan orchestration, environment readiness, tuning, and false-positive reduction. Integrate DAST and automated API testing into CI/CD pipelines using repeatable, maintainable security-as-code patterns. Create standards and runbooks for scan profiles, test data, authentication/session handling, and release readiness criteria. Perform triage and validate exploitability of findings, distinguishing between theoretical issues and meaningful application risk. Translate findings into clear, actionable developer remediation guidance, and partner with teams to verify effective fixes. API Security Engineering (Internet-Facing, Gateway, Discovery) Partner with API gateway and edge teams to implement and tune security controls such as schema/contract validation, request filtering, threat protections, rate limiting, and throttling. Drive API discovery and inventory capabilities to identify and govern “shadow” and “zombie” APIs and establish processes to bring them under security review and lifecycle management. Perform and automate security testing aligned to the OWASP API Security Top 10, including authorization failures such as BOLA/BFLA. Assess API exposure and abuse risk, including authentication/authorization weaknesses, object access patterns, input validation issues, data leakage, and business logic abuse. Help implement protections against abuse of exposed endpoints, including bot/automation defenses, scraping prevention, and volumetric misuse controls. RASP & Runtime Active Defense (In-Process Instrumentation) Deploy, configure, and tune runtime security solutions (such as RASP) integrated into application runtimes (e.g., JVM, .NET CLR) to monitor execution and defend against attacks in production. Establish safe rollout patterns (detect-only → tuned detection → selective enforcement), with guardrails to minimize performance impact and avoid breaking application behavior. Analyze runtime telemetry to identify attack patterns such as injection attempts, exploitation chains, abnormal access behavior, and policy violations. Tune runtime protections based on observed application behavior and threat patterns, with a focus on reducing exploitability while supporting development teams in achieving long-term remediation. Collaborate closely with developers and architects to ensure runtime protections complement, rather than replace, secure design and code-level fixes. Security Engineering & Collaboration Build and maintain metrics that reflect meaningful security outcomes, such as coverage, false-positive rate, exploit validation rate, time-to-triage, and time-to-remediation. Develop automation, integrations, scripts, and lightweight internal tooling to improve testing coverage, reduce manual effort, and extend security capabilities where needed. Create documentation, templates, and self-service enablement that help engineering teams adopt secure patterns and scale security practices. Support application/API-related security investigations by providing technical analysis, exploit context, and remediation guidance.

Requirements

5+ years (or equivalent) of experience in application security, product security, offensive security, or secure software engineering with strong hands-on technical depth.
Strong hands-on experience in web application and API security, including vulnerability identification, exploit validation, remediation support, and secure design considerations.
Demonstrated ability to evaluate, implement, and operationalize AI-assisted security tooling/workflows (build vs. buy), with a focus on measurable improvements in signal quality, coverage, and remediation efficiency.
Demonstrated experience scaling DAST and automated dynamic testing, including authenticated scanning, scan tuning, and CI/CD integration.
Strong expertise in API security, including OAuth2/OIDC, JWT, API gateways, authorization testing, and testing techniques for REST and GraphQL APIs.
Practical experience implementing and tuning RASP or similar in-process runtime protections in production environments.
Deep understanding of the OWASP Top 10 and OWASP API Security Top 10, especially authorization failures (BOLA/BFLA), injection, SSRF, deserialization, security misconfiguration, and business logic abuse.
Ability to write code and build technical solutions to automate workflows, develop integrations, create test harnesses/utilities, or build lightweight internal security tools when needed.
Proficiency in one or more scripting/programming languages such as Python, Go, JavaScript, or Bash, with demonstrated ability to apply coding skills to security engineering problems.
Strong understanding of modern application architectures, including APIs, microservices, cloud-native design patterns, authentication flows, and runtime environments.
Working knowledge of cloud-native platforms and production concepts (containers, Kubernetes, observability/logging/tracing), with the ability to use that knowledge in support of application security engineering.
Strong communication skills and the ability to translate security findings into clear, prioritized engineering actions for developers and stakeholders.

Nice To Haves

Experience developing internal security tools, custom integrations, reusable libraries, or testing frameworks to extend AppSec capabilities.
Background in offensive security, adversarial testing, bug bounty, web exploitation, or vulnerability research.
Experience applying analytics/ML concepts to security telemetry (behavior baselining, anomaly detection, clustering/deduplication) for APIs and runtime signals.
Familiarity with AI-assisted secure SDLC use cases such as code/query generation for test cases, guided threat modeling, and intelligent fuzzing, with strong validation practices.
Experience defining quality metrics for AI outputs (precision/recall proxies, FP/FN tracking, drift detection) and operating feedback loops.
Experience with API discovery platforms and managing shadow/zombie API reduction programs (inventory, ownership, governance workflows).
Hands-on experience with GraphQL-specific risks, including introspection exposure, depth/complexity attacks, and field-level authorization weaknesses.
Experience designing safe enforcement strategies for production protections, including progressive rollout, canarying, SLO awareness, and performance testing.
Familiarity with service mesh patterns (mTLS, traffic policies) and edge protections (WAF/WAAP concepts) as they relate to API protection.
Relevant certifications such as OSWE, GIAC GWAPT/GWEB, or similar hands-on application security credentials.

Responsibilities

Own and scale dynamic security capabilities across the Software Delivery Lifecycle (SDLC) and production, with a strong emphasis on: DAST automation and integration into CI/CD pipelines, RASP and in-process runtime protection (e.g., JVM/.NET CLR instrumentation), API Security engineering for internal and external/internet-facing endpoints, including edge/API gateway protections and continuous API discovery (shadow/zombie APIs).
Assess real-world exploitability, validate findings, work directly with developers on durable remediation, and build or extend automation in code when existing tooling does not fully solve the problem.
Partner closely with security teams, platform teams, and developers to define policy, deploy controls safely, tune security tool detections, reduce false positives, and measurably improve security outcomes.
Identify practical opportunities to apply AI-assisted approaches across DAST, API testing, runtime telemetry, and security workflows (e.g., prioritization, correlation, anomaly detection, automated enrichment, and remediation support).
Implement AI-enabled workflows to reduce false positives, improve triage efficiency, and accelerate remediation (e.g., intelligent deduplication, exploitability scoring, and auto-generated developer guidance with human review).
Partner with platform and engineering teams to integrate AI-assisted and automated security capabilities into pipelines and operational processes in a measurable, repeatable, and secure way.
Own the DAST lifecycle, including onboarding, authenticated scanning, scan orchestration, environment readiness, tuning, and false-positive reduction.
Integrate DAST and automated API testing into CI/CD pipelines using repeatable, maintainable security-as-code patterns.
Create standards and runbooks for scan profiles, test data, authentication/session handling, and release readiness criteria.
Perform triage and validate exploitability of findings, distinguishing between theoretical issues and meaningful application risk.
Translate findings into clear, actionable developer remediation guidance, and partner with teams to verify effective fixes.
Partner with API gateway and edge teams to implement and tune security controls such as schema/contract validation, request filtering, threat protections, rate limiting, and throttling.
Drive API discovery and inventory capabilities to identify and govern “shadow” and “zombie” APIs and establish processes to bring them under security review and lifecycle management.
Perform and automate security testing aligned to the OWASP API Security Top 10, including authorization failures such as BOLA/BFLA.
Assess API exposure and abuse risk, including authentication/authorization weaknesses, object access patterns, input validation issues, data leakage, and business logic abuse.
Help implement protections against abuse of exposed endpoints, including bot/automation defenses, scraping prevention, and volumetric misuse controls.
Deploy, configure, and tune runtime security solutions (such as RASP) integrated into application runtimes (e.g., JVM, .NET CLR) to monitor execution and defend against attacks in production.
Establish safe rollout patterns (detect-only → tuned detection → selective enforcement), with guardrails to minimize performance impact and avoid breaking application behavior.
Analyze runtime telemetry to identify attack patterns such as injection attempts, exploitation chains, abnormal access behavior, and policy violations.
Tune runtime protections based on observed application behavior and threat patterns, with a focus on reducing exploitability while supporting development teams in achieving long-term remediation.
Collaborate closely with developers and architects to ensure runtime protections complement, rather than replace, secure design and code-level fixes.
Build and maintain metrics that reflect meaningful security outcomes, such as coverage, false-positive rate, exploit validation rate, time-to-triage, and time-to-remediation.
Develop automation, integrations, scripts, and lightweight internal tooling to improve testing coverage, reduce manual effort, and extend security capabilities where needed.
Create documentation, templates, and self-service enablement that help engineering teams adopt secure patterns and scale security practices.
Support application/API-related security investigations by providing technical analysis, exploit context, and remediation guidance.

Benefits

Medical/Dental/Vision coverage
401(k) plan
Tuition reimbursement program
Paid Time Off and Holidays (based on date of hire, at least 23 days of vacation each year and 9 company-designated holidays)
Paid Parental Leave
Paid Caregiver Leave
Additional sick leave beyond what state and local law require may be available but is unprotected
Adoption Reimbursement
Disability Benefits (short term and long term)
Life and Accidental Death Insurance
Supplemental benefit programs: critical illness/accident hospital indemnity/group legal
Employee Assistance Programs (EAP)
Extensive employee wellness programs
Employee discounts up to 50% off on eligible AT&T mobility plans and accessories, AT&T internet (and fiber where available) and AT&T phone