Sr. Application Security Engineer (Hybrid/Miami Lakes)

BankUnited • Miami Lakes, FL

127d

About The Position

The Sr. Application Security Engineer is responsible for leading the secure development and delivery of applications, services, and cloud workloads across BankUnited. This role combines deep technical expertise with strategic oversight to ensure that security is embedded into the software development lifecycle (SDLC), DevSecOps pipelines, and cloud architectures. The Engineer partners closely with development, DevOps, cloud, and security architecture teams to design, implement, and validate security controls--while providing technical guidance in application threat modeling, secure coding, and vulnerability remediation.

Requirements

• Bachelor's Degree or Master's degree in Computer Science, Information Technology, Cybersecurity, or related field.
• 3-5 years of experience in application security, cloud security, or DevSecOps roles.
• Hands-on experience with application security testing tools such as Veracode, GitHub Dependabot, Wiz, StackHawk.
• Proficiency in at least one programming or scripting language (Python, PowerShell, .NET, Rego, JavaScript).
• Experience with IaC security tools (Terraform, CloudFormation).
• Strong understanding of SDLC methodologies, CI/CD security integration, and DevSecOps principles.
• Familiarity with compliance frameworks and regulatory requirements (NIST CSF, PCI-DSS, SOX, GLBA).
• Experience with container orchestration platforms (Docker, Kubernetes, EKS/AKS) and their security hardening preferred.
• Background in financial services or other highly regulated industries preferred.
• Experience with threat modeling methodologies (PASTA, STRIDE) preferred.

Nice To Haves

• CSSLP, CISSP, CCSP, GCSA, AWS/Azure Security Specialty preferred.

Responsibilities

• Oversee application security initiatives, ensuring security is integrated into all stages of the SDLC.
• Establish, implement, and maintain DevSecOps security standards, procedures, and automation pipelines.
• Perform application threat modeling to identify and address risks during design and development phases.
• Conduct security code reviews, dynamic application security testing (DAST), and static application security testing (SAST).
• Assess the security posture of web, mobile, and SaaS/PaaS/IaaS applications.
• Provide remediation guidance to developers and ensure vulnerabilities are addressed in line with SLAs.
• Evaluate encryption algorithms, key management practices, and cryptographic implementations.
• Develop and track application security metrics, KPIs, and program maturity measures.
• Design and implement secure Infrastructure-as-Code (IaC) templates using tools like Terraform and CloudFormation.
• Implement cloud deployment security automation and container security hardening.
• Perform vulnerability assessments and risk analysis for cloud-native and hybrid workloads.
• Maintain deep knowledge of AWS and/or Azure security services, IAM, and cloud-native security tools.
• Research emerging security threats, vulnerabilities, and frameworks to inform security strategy.
• Create, maintain, and disseminate application security policies, standards, and guidelines to development teams.
• Collaborate with architecture, engineering, and product teams to align on secure design patterns and requirements.
• Support security initiatives focused on secure coding practices and secure system design.
• Partner with leadership to evaluate new security tools, technologies, and integrations for application and cloud security.
• Support compliance audits and provide technical evidence for regulatory requirements (NIST CSF, PCI-DSS, SOX, GLBA).
• Adhere to and comply with applicable federal and state laws, regulations and guidance, including those related to anti-money laundering.
• Identify and report suspicious activity.

What This Job Offers

• Industry: Wholesale Trade Agents and Brokers
• Education Level: Bachelor's degree