Senior Application Security Engineer ID87004

AgileEngine•Fort Lauderdale, FL

About The Position

AgileEngine is an Inc. 5000 software company that develops software for Fortune 500 brands and startups across more than 17 industries. The Senior Application Security Engineer will strengthen secure coding and DevSecOps practices across engineering teams. The role deploys and tunes SAST, DAST, and IAST tools, conducts application threat modeling, and integrates security controls into CI/CD pipelines. The engineer should be comfortable working with Python, JavaScript, Java, or similar languages and cloud infrastructure such as AWS. The position works with engineering teams and technology stakeholders to identify and prioritize meaningful security risks, improve remediation, establish security metrics, and advance application security through automation. The role also ensures that processes for key systems are documented, maintained, and archived. AgileEngine describes a people-first culture and offers professional growth opportunities, competitive USD-based compensation with education, fitness, and team activity budgets, exciting projects, and flexible scheduling with remote and office options.

Requirements

At least 4 years of hands-on application security experience in a modern software-development environment.
A software engineering foundation and ability to read, understand, and discuss code in Python, JavaScript, Java, or similar languages.
Deep experience deploying, tuning, and interpreting SAST and DAST tools.
Demonstrated experience conducting threat modeling and translating findings into practical security requirements.
Experience integrating security testing and controls into CI/CD pipelines and developer workflows.
Working knowledge of AWS or cloud application security, APIs, authentication and authorization, secrets management, and common web-application vulnerabilities.
Experience with infrastructure-as-code and automation tools such as Terraform, CloudFormation, Ansible, Puppet, Chef, or Salt.
Ability to prioritize genuine security risks, reduce scanner noise, and drive timely remediation of meaningful vulnerabilities.
Strong communication and influence skills, including explaining complex security issues to engineers, engineering leaders, and nontechnical stakeholders.
Collaborative, solutions-oriented approach and ability to build trust with development teams while improving security without unnecessarily slowing product delivery.
Upper-intermediate English level.
Authorization to work for any employer in the United States; the company is unable to sponsor or take over employment visa sponsorship.

Nice To Haves

IAST experience.
Familiarity with security tools such as Nessus, Burp, and web application firewalls.
Experience with static and dynamic application security testing methodologies and tools.
Experience conducting a detailed threat-model exercise.
Experience assessing CI/CD pipelines from a security perspective and integrating security tools into them.
Experience with cloud-based infrastructure and technologies, preferably AWS.
Ability and willingness to collaborate across the engineering organization to establish a security posture.
Results-oriented approach and commitment to steady continuous improvement.
Curiosity and interest in investigating underlying causes.
Effective communication and a solution-oriented mindset.
Strategic thinking that integrates current initiatives and identifies improvements while meeting business needs.

Responsibilities

Deploy and tune code-scanning solutions, including SAST, DAST, and IAST.
Interpret scan results and help teams prioritize remediation of the highest-risk vulnerabilities.
Threat-model applications to identify potential attack vectors and risks of disruption or data breaches.
Collaborate with technology stakeholders to establish metrics demonstrating application security proficiency across engineering teams.
Guide development of automation and other tools that improve application security and make security improvements faster and easier for teams.
Ensure processes associated with key systems are documented, maintained, and archived.
Strengthen secure coding and DevSecOps practices across engineering teams.
Integrate security testing and controls into CI/CD pipelines and developer workflows.