Senior Application Security Engineer - DevSecOps

Role: We are looking for a Senior Application Security Engineer with strong DevSecOps experience to secure enterprise applications throughout the Software Development Lifecycle. The ideal candidate should have hands-on experience implementing SAST, DAST and SCA within CI/CD pipelines, working with GitHub/GitLab, and collaborating with development teams to remediate security vulnerabilities. Description: 1. Monitor and Analyze Vulnerabilities: - Use established scanning tools and processes to identify security issues in mobile and web applications. - Review scan results, verify risk levels, and recommend remediation strategies to application or engineering teams. 2. Contribute to Security Assessments: - Participate in ongoing risk-based discussions with product owners, third-party engineers, and other stakeholders about application vulnerabilities. - Help track and prioritize vulnerabilities according to established timelines and business impact. 3. Maintain Scanning Profiles & Policies: - Follow and apply existing application security scan profiles and policies (containers, SAST, DAST, and crowd-sourced pen testing). - Onboard new applications into scanning services and ensure adherence to brand-wide security standards. 4. Collaborate on Awareness & Best Practices: - Support awareness campaigns and training programs to ensure application development teams follow existing security standards. - Provide input to engineering teams on secure coding and design principles, referencing frameworks like the OWASP Top 10. 5. Vulnerability Monitoring & Remediation Support: - Continuously monitor published vulnerabilities across various applications, operating systems, and databases. - Assist in determining remediation priorities, coordinate with stakeholders, and re-scan to verify fixes. - Collaborate with engineers for threat modeling and incident response, offering analytic support in root cause analysis. 6. Incident Response Collaboration: - Work with incident response teams to investigate security incidents affecting applications. - Help document findings, track remediation progress, and apply lessons learned to future prevention activities. Basic Qualifications: - Bachelors degree and at least 7 years of combined experience in cybersecurity and/or software development. (Equivalent experience may be considered in lieu of a degree.) - Practical understanding of application cybersecurity vulnerabilities, the ability to assess their relevance, and experience planning remediation efforts. - Strong communication skills to collaborate with technical personnel and third parties on vulnerability findings. - Familiarity with continuous integration/continuous delivery (CI/CD) platforms. - Awareness of compliance and data privacy regulations (e.g., PCI DSS, GDPR, CCPA) and their impact on application security. - General knowledge of common programming languages and paradigms (OOP, functional, concurrent, etc.). Technical Qualifications: - Understanding of cloud environment security concepts (secrets management, infrastructure as code, serverless). - Familiarity with CI/CD build/deployment pipeline technologies. - Experience with application scanning tools (dynamic and static techniques) to interpret vulnerabilities and support remediation. - Basic knowledge of containers and container management tools (e.g., Docker, Kubernetes), with the ability to recognize security findings and escalate them to engineering for remediation. - Knowledge of HTTP communication fundamentals. - Awareness of package management tools (npm, pip, apt) for operating systems or development languages.