Senior Application Security Engineer

Blue Cross Blue Shield of Nebraska•Omaha, NE

1d•Hybrid

About The Position

Blue Cross and Blue Shield of Nebraska is seeking a Senior Application Security Engineer to serve as a technical leader and owner of the organization’s application security capabilities. The role implements and operates secure software development practices across the enterprise, focusing on static and dynamic code analysis, DevSecOps integration, AI-related code risk, and risk-based vulnerability management. The engineer is expected to work independently, own outcomes, and partner with engineering, architecture, and risk teams to deliver practical, scalable security solutions. The position offers remote flexibility with one day per week in the Omaha, Nebraska office. The preferred candidate lives within driving distance of that office. Candidates living in approved states—Florida, Iowa, Kansas, Minnesota, Missouri, Nebraska, North Dakota, and Texas—may need to travel to headquarters based on business needs. On-call work may be required depending on business needs and role assignment.

Requirements

Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent experience.
Six years of experience in application security, secure software development, or DevSecOps.
Hands-on experience with SAST, DAST, and dependency scanning tools, including tuning and operational ownership.
Strong understanding of application vulnerability classes, including OWASP Top 10, APIs, authentication, and authorization.
Experience integrating security into CI/CD pipelines and development workflows.
Ability to assess risk, prioritize remediation, and clearly communicate decisions.
Ability to work independently, take ownership, and drive outcomes with minimal oversight.
Strong communication skills and ability to work effectively with developers, architects, and leadership.
Ability to perform the essential duties satisfactorily, with reasonable accommodations available for individuals with disabilities.
Ability to meet attendance and timeliness requirements and work well in a team environment.

Nice To Haves

Experience in healthcare or other regulated industries.
Familiarity with Azure PaaS and cloud-native application architectures.
Exposure to AI-assisted development risks, automation, or modern code-generation tools.
Threat modeling experience and participation in security design reviews.
Scripting or automation experience with Python, PowerShell, or Bash.
Relevant certifications such as CSSLP, GWAPT, CISSP, or equivalent.
Equivalent combinations of education and experience may be considered.

Responsibilities

Own and operate application security tooling, including SAST, DAST, and software composition analysis, and ensure tools are tuned, effective, and aligned to business risk.
Embed application security into CI/CD pipelines and development workflows while minimizing developer friction.
Perform secure code reviews and validate vulnerabilities for exploitability, impact, and remediation feasibility.
Define and maintain secure coding standards, guidance, and reusable security patterns for development teams.
Establish guardrails and review expectations for AI-assisted and AI-generated code.
Partner with development teams to triage findings, reduce false positives, and drive remediation.
Apply risk-based decision making aligned with organizational risk appetite and compliance frameworks, including NIST, HIPAA, and SOC 2.
Support application threat modeling and identify architectural security gaps.
Collaborate with cloud, platform, and identity teams to ensure applications integrate securely with enterprise services.
Contribute to audit readiness, evidence collection, and regulatory support related to application security controls.
Document processes, mentor others, and improve program resiliency to reduce single points of failure.
Meet or exceed departmental attendance and timeliness requirements and maintain positive working relationships with staff, departments, and customers.
Perform other duties as assigned.