Senior Application Security Engineer
About The Position
The Senior Application Security Engineer serves as a technical leader and owner of company application security capabilities. The role implements and operates secure software development practices across the enterprise, focusing on static and dynamic code analysis, DevSecOps integration, AI-related code risk, and risk-based vulnerability management. The engineer is expected to work independently, own outcomes, and partner with engineering, architecture, and risk teams to deliver practical, scalable security solutions. The preferred candidate will live within driving distance of the Omaha, Nebraska office. The role allows remote flexibility and requires one day per week in the office. Employees living in approved states—Florida, Iowa, Kansas, Minnesota, Missouri, Nebraska, North Dakota, and Texas—may travel to headquarters based on business needs. On-call work may be required based on business needs and role assignment.
Requirements
- Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent experience.
- Six years of experience in application security, secure software development, or DevSecOps.
- Hands-on experience with SAST, DAST, and dependency scanning tools, including tuning and operational ownership.
- Strong understanding of application vulnerability classes, including OWASP Top 10, APIs, authentication, and authorization.
- Experience integrating security into CI/CD pipelines and development workflows.
- Ability to assess risk, prioritize remediation, and clearly communicate decisions.
- Ability to work independently, take ownership, and drive outcomes with minimal oversight.
- Strong communication skills and ability to work effectively with developers, architects, and leadership.
- Ability to meet or exceed departmental attendance and timeliness requirements.
- Ability to work well in a team and build and maintain positive relationships with staff, departments, and customers.
Nice To Haves
- Experience in healthcare or other regulated industries.
- Familiarity with Azure PaaS and cloud-native application architectures.
- Exposure to AI-assisted development risks, automation, or modern code-generation tools.
- Threat modeling experience and participation in security design reviews.
- Scripting or automation experience with Python, PowerShell, or Bash.
- Relevant certifications such as CSSLP, GWAPT, CISSP, or equivalent.
Responsibilities
- Own and operate application security tools, including SAST, DAST, and software composition analysis, ensuring they are tuned, effective, and aligned with business risk.
- Integrate application security into CI/CD pipelines and development workflows to support shift-left security while minimizing developer friction.
- Perform secure code reviews and assess vulnerabilities for exploitability, impact, and remediation feasibility.
- Define and maintain secure coding standards, guidance, and reusable security patterns for development teams.
- Establish guardrails and review expectations for AI-assisted and AI-generated code to reduce unowned and unmanaged application risk.
- Partner with development teams to triage findings, reduce false positives, and drive effective remediation.
- Apply risk-based decision-making aligned with organizational risk appetite and compliance frameworks, including NIST, HIPAA, and SOC 2.
- Support application threat modeling and identify architectural security gaps.
- Collaborate with cloud, platform, and identity teams to ensure applications integrate securely with enterprise services.
- Contribute to audit readiness, evidence collection, and regulatory support related to application security controls.
- Document processes, mentor others, and improve program resiliency to reduce single points of failure.
Benefits
- Comprehensive Total Rewards package.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
