Staff Application Security Engineer

TRIMEDX•Indianapolis, IN

1d•Remote

About The Position

Trimedx is hiring a Staff Application Security Engineer to own and advance the company’s application security program. The role sets strategy and security architecture standards for web and cloud-native workloads, partners with development teams from architecture and design through implementation, and builds scalable practices across approximately 6–10 development teams. The engineer operates autonomously, makes and documents security architecture decisions, and balances security risks with development capacity while avoiding controls that create bottlenecks. The position owns the AppSec toolchain and program processes, including threat modeling, security champions and developer training, vulnerability findings triage, exception management, risk tracking, and remediation oversight. It also supports audit readiness for ISO 27001 Annex A.8 and SOC 2 secure-development criteria, reports program health and metrics to IT leadership, and serves as the primary AppSec liaison among application teams, infrastructure security, leadership, and external penetration-testing vendors. The role tracks emerging AI security trends and supports safe AI adoption. The posting is marked #LI-Remote.

Requirements

Experience building and owning an application security program and setting its strategy and roadmap.
Ability to define security architecture standards for web and cloud-native workloads.
Ability to conduct threat modeling using STRIDE or an equivalent approach.
Experience designing and managing application security tools, including SAST, SCA, secrets scanning, container image scanning, and DAST, and integrating them into CI/CD pipelines.
Ability to evaluate security tools and approaches and document defensible architecture decisions without an existing playbook.
Ability to scale security controls across multiple development teams without creating a bottleneck.
Ability to prioritize security debt and recommend risk-based trade-offs given capacity constraints.
Ability to make decisions autonomously, document them, and communicate program health, findings, and metrics to leadership.
Ability to lead design reviews and threat-modeling sessions and influence teams through technical credibility and relationships.

Responsibilities

Own the application security program strategy and roadmap and define security architecture standards for web and cloud-native workloads.
Manage the security exception and waiver process and report program health and metrics to IT leadership quarterly.
Partner with development teams during architecture and design; conduct threat modeling for new systems and significant features.
Build and sustain a security champions program and deliver developer security training suited to participants’ skill levels.
Design and own the application security toolchain, including SAST, SCA, secrets scanning, container image scanning, and DAST; integrate tools into CI/CD pipelines and manage findings triage and false-positive reduction.
Conduct or commission architecture security reviews for new platforms and major system changes.
Scope and coordinate external penetration testing and track remediation against service-level agreements.
Maintain audit-ready evidence for ISO 27001 Annex A.8 controls, support SOC 2 secure-development criteria, own the AppSec risk register, and participate in audits as the subject matter expert.
Serve as the primary interface among application teams, infrastructure security, and IT leadership on application security matters.
Track emerging AI security trends and support safe AI adoption within InfoSec and across the company.
Make and document security architecture decisions; escalate highly complex cross-functional or resourcing issues to IT leadership.
Communicate security standards, risk summaries, findings, and program reports clearly to technical and non-technical audiences.
Build credibility and drive secure-development outcomes through relationships and technical influence.
Perform all other duties as assigned.