Security Engineering, Associate / Assistant Vice President

Mitsubishi UFJ Financial Group • Jersey City, NJ

7d • Hybrid

About The Position

This role focuses on application security testing and vulnerability management throughout the software development lifecycle. The associate or assistant vice president uses automated and manual testing to identify and help remediate security flaws in application code and open-source components, integrating security into DevOps workflows and supporting compliance with relevant frameworks. The role works closely with development, DevOps, and application-owner teams to improve enterprise application security and help teams build secure software.

The selected colleague will work at an MUFG office or client sites four days per week and remotely one day per week. The role requires over five years of hands-on application security experience, secure development practices, and automation in CI/CD environments. The typical base pay range is $113,000–$146,000, depending on job-related knowledge, skills, experience, and location. The role may also be eligible for discretionary performance-based bonus and/or incentive compensation.

Requirements

• Bachelor's degree in Computer Science, Cybersecurity, or a related field, or equivalent experience.
• At least 5 years of experience in Application Security, Secure Development, DAST, and SAST.
• Hands-on experience with DAST tools such as Invicti (Netsparker), AppScan, Burp Suite, or Acunetix.
• Experience with SAST tools such as Veracode and Fortify.
• Experience using Burp Suite for manual testing.
• Strong knowledge of web security vulnerabilities, including OWASP Top 10, SANS 25, and MITRE ATT&CK.
• Software development experience in Java, .NET, Python, or similar languages.
• Ability to perform scripting for security engineering.
• Familiarity with secure software development lifecycle (SSDLC) practices and CI/CD pipelines.
• Scripting skills in Python, Bash, or PowerShell to automate security tasks.
• Ability to collaborate with developers and provide constructive security guidance.
• Excellent communication skills, including technical reporting and vulnerability documentation.
• Analytical mindset and interest in improving software security and reducing risk exposure.

Nice To Haves

• Relevant security certifications such as OSCP, OSWE, GWAPT, or CEH are highly desirable.
• Experience with cloud security, including AWS, Azure, or Oracle Cloud.

Responsibilities

• Conduct DAST scans using Invicti to identify application vulnerabilities.
• Conduct SAST scans using Veracode to identify source-code vulnerabilities and SCA scans using Veracode to identify vulnerabilities in open-source components.
• Compare SAST and DAST results to ensure comprehensive vulnerability coverage.
• Analyze scan results, identify root causes, and collaborate with developers on effective remediations.
• Integrate security testing into CI/CD pipelines and DevOps workflows.
• Perform manual verification and secondary authenticated scans using Burp Suite as needed to reduce false negatives.
• Evaluate vulnerabilities in Java, .NET, Python, and other application codebases.
• Help development teams remediate source-code flaws and follow secure coding practices.
• Provide guidance on OWASP Top 10 and SANS 25 vulnerabilities, including their causes, exploitation, and prevention.
• Perform scripting and coding in Java and Python as needed for security engineering.
• Ensure required release and periodic DAST, SAST, and SCA scans occur and that scans and findings are addressed within SLA.
• Review and approve false positives and mitigated-by-design requests for DAST, SAST, and SCA.
• Review and approve SDLC tasks for DAST, SAST, and SCA, including MME and SbD MUFG processes.
• Maintain compliance with NIST, PCI-DSS, FFIEC, SOX, and CIS security frameworks.
• Store and organize security artifacts in archives using standardized documentation practices.
• Work with developers, DevOps teams, and application owners to secure software throughout the SDLC.
• Automate security scanning processes through scripting and improve reporting capabilities.
• Stay current with exploitation techniques, security research, and industry best practices.

Benefits

• Comprehensive health and wellness benefits.
• Retirement plans.
• Educational assistance and training programs.
• Income replacement for qualified employees with disabilities.
• Paid maternity and parental bonding leave.
• Paid vacation, sick days, and holidays.
• May be eligible for discretionary performance-based bonus and/or incentive compensation.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level