Security Engineering, Associate / Assistant Vice President

MUFG•Jersey City, NJ

9d•$113,000 - $146,000•Hybrid

About The Position

The Security Engineering role focuses on application security testing and vulnerability management across the software development lifecycle. The colleague conducts automated and manual security scans to identify and remediate flaws in application code and open-source components, works with development and DevOps teams, applies secure coding expertise, and supports compliance with applicable security frameworks. The role uses tools including Invicti, Veracode, and Burp Suite and integrates security testing into CI/CD workflows. The role’s goal is to strengthen the security posture of enterprise applications by proactively identifying and remediating security risks, embedding security into DevOps workflows, and supporting compliance with industry standards. The colleague collaborates with development teams to help them build secure software from the ground up. The selected colleague works at an MUFG office or client site four days per week and remotely one day per week. The position may be eligible for discretionary performance-based bonus or incentive compensation. MUFG describes its Total Rewards package as including comprehensive health and wellness benefits, retirement plans, educational assistance and training programs, income replacement for qualified employees with disabilities, paid maternity and parental bonding leave, and paid vacation, sick days, and holidays.

Requirements

Bachelor's degree in Computer Science, Cybersecurity, or a related field, or equivalent experience.
At least 5 years of experience in Application Security, Secure Development, DAST, and SAST.
Hands-on experience with DAST tools such as Invicti (Netsparker), AppScan, Burp Suite, or Acunetix.
Experience with SAST tools such as Veracode and Fortify.
Experience performing manual testing with Burp Suite.
Strong knowledge of web security vulnerabilities, including OWASP Top 10, SANS 25, and MITRE ATT&CK.
Software development experience in Java, .NET, Python, or similar languages, and ability to script for security engineering.
Familiarity with secure software development lifecycle (SSDLC) and CI/CD pipelines.
Scripting skills in Python, Bash, or PowerShell for automating security tasks.
Ability to collaborate with developers and provide constructive security guidance.
Excellent communication skills, including technical reporting and vulnerability documentation.
Analytical mindset and interest in improving software security and reducing risk exposure.

Nice To Haves

Relevant security certifications such as OSCP, OSWE, GWAPT, or CEH are highly desirable.
Experience with cloud security in AWS, Azure, or Oracle Cloud.

Responsibilities

Conduct DAST scans using Invicti to identify application vulnerabilities.
Conduct SAST scans using Veracode to identify vulnerabilities in source code.
Conduct SCA scans using Veracode to identify vulnerabilities in open-source components.
Compare SAST and DAST results to ensure comprehensive vulnerability coverage.
Analyze scan results, identify root causes, and collaborate with developers on effective remediation.
Work with CI/CD pipelines to integrate security testing into DevOps workflows.
As needed, conduct manual verification and secondary authenticated scans using Burp Suite to reduce false negatives.
Evaluate vulnerabilities in Java, .NET, Python, and other application codebases.
Help development teams remediate source-code flaws and follow secure coding practices.
Provide guidance on OWASP Top 10 and SANS 25 vulnerabilities, including their causes, exploitation, and prevention.
Perform Java and Python scripting and coding for security engineering as needed.
Ensure required DAST, SAST, and SCA release and periodic scanning takes place and that scans and findings are addressed within SLA.
Review and approve false positives and mitigated-by-design requests for DAST, SAST, and SCA.
Review and approve SDLC tasks (MME and SbD MUFG processes) for DAST, SAST, and SCA.
Maintain compliance with NIST, PCI-DSS, FFIEC, SOX, and CIS security frameworks.
Store and organize security artifacts in archives using standardized documentation practices.
Work with developers, DevOps teams, and application owners to secure software throughout the SDLC.
Automate security scanning through scripting and improve reporting capabilities.
Stay current on exploitation techniques, security research, and industry best practices.