Senior Application Security Engineer ID87004

AgileEngine•Boca Raton, FL

About The Position

AgileEngine is seeking a Senior Application Security Engineer to strengthen secure coding and DevSecOps practices across engineering teams. The role deploys and tunes SAST, DAST, and IAST tools, conducts threat modeling, and integrates security controls into CI/CD pipelines. It requires comfort working across programming languages such as Python, JavaScript, or Java and cloud infrastructure such as AWS. The engineer will help enable the agile development of secure and reliable applications and products. They will interpret scanning results to focus teams on high-risk vulnerabilities, collaborate with technology stakeholders on application security metrics, support automation that makes security improvements faster and easier, and ensure key-system processes are documented, maintained, and archived. Candidates must be authorized to work for any employer in the United States; the company cannot sponsor or take over employment visa sponsorship at this time. AgileEngine offers professional growth opportunities, USD-based compensation with education, fitness, and team activity budgets, exciting projects, and a flexible schedule with remote and office options.

Requirements

At least 4 years of hands-on application security experience in a modern software-development environment.
A software engineering foundation and ability to read, understand, and discuss code in Python, JavaScript, Java, or similar languages.
Deep experience deploying, tuning, and interpreting SAST and DAST tools; IAST experience is a plus.
Demonstrated experience conducting threat modeling and translating findings into practical security requirements.
Experience integrating security testing and controls into CI/CD pipelines and developer workflows.
Working knowledge of AWS or cloud application security, APIs, authentication and authorization, secrets management, and common web-application vulnerabilities.
Experience with infrastructure-as-code and automation tools such as Terraform, CloudFormation, Ansible, Puppet, Chef, or Salt.
Ability to prioritize meaningful security risks, reduce scanner noise, and drive timely vulnerability remediation.
Strong communication and influence skills, including explaining complex security issues to engineers, engineering leaders, and nontechnical stakeholders.
Collaborative, solutions-oriented approach and ability to build trust with development teams.
Upper-intermediate English level.
Authorization to work for any employer in the United States; employer visa sponsorship or takeover is not available.

Nice To Haves

IAST experience.
Familiarity with Nessus, Burp, and web application firewalls.
Experience with static and dynamic application security testing methodologies and tools.
Experience conducting detailed threat-model exercises.
Experience assessing CI/CD pipelines from a security perspective and integrating security tools into them.
Experience with cloud-based infrastructure and technologies, preferably AWS.
Collaborative approach to partnering across engineering to establish a security posture.
Results-oriented mindset and commitment to steady continuous improvement.
Curiosity and willingness to investigate underlying causes.
Effective communication and a solution-oriented mindset.
Strategic thinking that integrates current initiatives and identifies improvements while meeting business needs.

Responsibilities

Deploy and tune code-scanning solutions, including SAST, DAST, and IAST.
Interpret code-scanning results and focus remediation on the highest-risk vulnerabilities.
Conduct application threat modeling to identify threat vectors that could lead to disruption or data breaches.
Collaborate with technology stakeholders to establish metrics demonstrating application security proficiency across engineering teams.
Steer development of tools and automation that improve application security and make security gains faster and easier for teams.
Ensure processes associated with key systems are documented, maintained, and archived.
Integrate security testing and controls into CI/CD pipelines and developer workflows.
Work collaboratively with development teams to improve security without unnecessarily slowing product delivery.