Senior Application Security Engineer

Fragomen•Ontario, CA

About The Position

Fragomen is seeking an Application Security Engineer to join its Cyber Security team in the Technology Innovation Lab in Pittsburgh. The company’s immigration-specific software and supporting infrastructure are undergoing significant transformation, with security playing a critical role. The successful candidate will help build a strong application security program, engineer secure software development solutions, and identify and mitigate threats and vulnerabilities across the environment.

Requirements

A bachelor's degree in a related field or a combination of related experience.
At least 5 years of web application development experience, such as .NET, Python, or Java.
Experience with Secure SDLC, DAST, and SAST.
One or more technical certifications demonstrating cybersecurity expertise, such as GSEC, CISSP, OSCP, AWS SCS-C01, or Microsoft SC-400.
Demonstrated understanding of web application penetration testing, secure coding, and source code analysis.
Strong professional communication skills, including the ability to maintain them under pressure.
A collaborative, curious team player who builds knowledge and solves complex problems.

Nice To Haves

Experience developing highly automated detection and triage tools.
Deep understanding of cybersecurity red-team techniques.
Expertise in IAM, PAM, and data protection tools.
Experience with cloud-native security tools.
A technical certification in secure software development, such as CSSLP, CASE, or similar.

Responsibilities

Build, deploy, and maintain tooling to validate and track security controls in and around code.
Work with application development and infrastructure architecture teams to create software that is secure by design and default.
Create programmatic code reviews and automate penetration testing to reduce the potential introduction of vulnerabilities.
Lead and collaborate with developers on secure coding techniques and threat modeling.
Contribute to vulnerability detection and remediation across technological offerings.
Deploy developed or off-the-shelf security applications to support security efforts.
Participate in cross-functional responses to cybersecurity incidents.
Work with the security team to establish prevention, detection, and mitigation techniques.
Deliver security guidance aligned with NIST, ISO, SOC 2, and other frameworks.
Support the scoping and rules of engagement for the penetration testing program.