Top Application Security Engineer Jobs

Designs and audits application security controls for mission-critical space systems subject to DoD compliance requirements. Responsibilities include security architecture documentation, vulnerability management, secure code reviews, SAST/SCA/DAST tool management, incident response playbooks, security training, secure coding enablement, and third-party security solution integration. Requires application security experience, production coding ability, cloud security knowledge, compliance framework experience, and eligibility for Secret or TS/SCI clearance.

Designs and audits application security controls for mission-critical space systems supporting government authorization and DoD compliance. Responsibilities include security architecture documentation, vulnerability management, secure code reviews, SAST/SCA/DAST tooling, incident response playbooks, security training, cloud security, and collaboration with engineering teams to implement secure coding practices and Zero Trust controls.

The Security Engineer role involves identifying vulnerabilities, automating tasks in penetration testing, and creating security reports for various audiences.

Own application security for Generative AI and emerging products by integrating secure development practices, conducting design and code reviews, threat modeling systems, assessing vendors and AI tools, triaging vulnerabilities, and building security automation. The role partners with engineering and detection teams, contributes to cloud and infrastructure security, participates in incident response and on-call rotations, and documents post-incident remediation.

Secure ServiceNow instances by assessing configurations against security baselines, identifying misconfigurations, validating customer-reported findings, and providing actionable remediation guidance. The role develops hardening guidance, distinguishes product vulnerabilities from configuration issues, partners with Product Security and Engineering, supports customer escalations, and drives scalable improvements to security tooling, detection, and risk-reduction processes.

Design and implement application security controls across cloud environments, assess cloud architectures for vulnerabilities and identity risks, conduct security reviews and penetration testing, monitor security events, support incident response, and develop cloud security requirements. Translate technical findings into remediation recommendations, interpret risk data, collaborate with clients, and mentor junior team members.

Manages application security assessments and client delivery across cloud environments. Designs security controls for IaaS, PaaS, and SaaS platforms; reviews architectures for vulnerabilities and control gaps; conducts risk assessments and vulnerability testing; guides remediation and security tool usage; monitors emerging threats; coaches security teams; and communicates findings to technical and business stakeholders.

Lead Apollo’s application security strategy across engineering, product, platform, data, and AI teams. Responsibilities include security architecture reviews, threat modeling, secure code review, penetration testing, exploit development, vulnerability management, secure-by-default building blocks, AI security standards, automation, and mentoring security engineers and champions. The role requires solving ambiguous, high-scale AppSec problems, influencing cross-functional roadmaps, and delivering measurable reductions in security risk.

The Senior Application Security Engineer will strengthen Apollo’s secure software development lifecycle through application security reviews, threat modeling, code analysis, vulnerability management, penetration testing, remediation, and AppSec tooling. The role includes developing automation, securing AI-powered features, improving security observability, enabling developers, and partnering across Engineering, Product, Platform, Data, Legal, and Security teams. This senior individual contributor will own long-term AppSec goals, resolve ambiguous risks, and drive cross-functional security improvements.

Secure applications, APIs, cloud services, and AI/LLM-enabled systems throughout the SDLC. Conduct threat modeling, architecture reviews, penetration tests, vulnerability triage, and remediation guidance. Integrate SAST, DAST, SCA, and secrets scanning into CI/CD pipelines; build secure automation and guardrails; support vulnerability disclosure; and coach developers on secure design and coding. The role protects sensitive clinical and genomic data while communicating security risks to engineering teams and leadership.

Conduct application security assessments, threat modeling, code reviews, and manual penetration testing across web applications, APIs, cloud services, appliances, and AI-enabled features. Coordinate external penetration tests, validate vulnerabilities, track remediation, and verify fixes. Improve SAST, SCA, secrets detection, container scanning, SBOM, supply-chain, and CI/CD security workflows while advising Engineering on secure design and risk prioritization.

Run and maintain an enterprise Burp Suite DAST program, including authenticated scans, CI/CD integrations, and Linux troubleshooting. Use Veracode SAST and development tools to integrate security testing into pipelines. Design enterprise security controls, assess web applications against OWASP and related standards, and align security activities with NIST, FIPS, and FedRAMP requirements. The role supports a federal financial regulatory agency and requires U.S. citizenship and Public Trust suitability.

The Application Security Engineer establishes security standards, performs penetration testing and secure code reviews, conducts threat modeling, and partners with developers to remediate vulnerabilities. The role manages WAFs, CI/CD security, identity and access controls, software supply chain security, cloud architecture reviews, AI-assisted development risks, privacy, payment security, and incident response. It also governs the secure SDLC, vulnerability management, secrets protection, API security, and security tooling across development teams.

Leads implementation and integration of Zero Trust application and network security controls across enterprise and DoD environments. Develops secure infrastructure, troubleshoots complex network issues, configures firewalls and application delivery platforms, implements micro-segmentation, and improves system security, reliability, and availability. The role also leads cross-functional teams and supports mission-critical national security networks.

Own application and product security across secure development standards, code review, threat modeling, security tooling, automated testing, sensitive-data protection, and secure software integrations. Partner with engineering teams to establish authentication, authorization, secrets-management, input-validation, permission-scoping, and code-level guardrails. Build automated security scans and AI-assisted review tools, and provide security reviews and release documentation.

Integrate security across the software development lifecycle for cloud-native mission applications. Responsibilities include secure architecture reviews, threat modeling, code review, security testing, vulnerability remediation, release authorization, DevSecOps automation, cloud and database security, risk assessment, and stakeholder communication. The role partners with software and cloud engineers using Kubernetes, containers, CI/CD pipelines, Oracle Cloud Infrastructure, and application security tools.

Performs application security assessments, DAST with Burp Suite Enterprise, SAST with Veracode, vulnerability analysis, remediation guidance, secure software development support, architecture reviews, compliance monitoring, and security reporting for a federal customer. The role secures web applications, APIs, and supporting infrastructure while supporting enterprise vulnerability management and federal cybersecurity requirements.

Lead application security for Snap’s Lens runtime and web clients. Own security architecture, threat modeling, sandboxing, isolation, web security, memory-safety improvements, vulnerability research, fuzzing, exploitability analysis, and bug bounty operations. Partner across native and web engineering teams, mentor engineers, establish secure design patterns, and drive complex security initiatives through resolution.

Owns the engineering lifecycle and operations of enterprise authentication and application security platforms. Maintains Java applications, configures MFA and authentication protocols, certifies SafeWord releases, validates security patches, and tests RADIUS integrations. Develops Bash and SQL automation, troubleshoots production issues, and supports migration from virtual machines to containerized OpenShift platforms. The role also requires Linux administration, monitoring with Splunk and AppDynamics, security documentation, and cross-functional collaboration.

Designs, implements, and administers F5 BIG-IP and inline break-and-inspect proxy solutions supporting DoD enterprise and cloud architectures. Configures and troubleshoots TLS and mutual TLS, applies cryptographic and PKI standards, and resolves architecture issues with DoD clients and stakeholders. The role requires Secret clearance, a high school diploma or GED, and up to 25% travel to CONUS and OCONUS locations.

Lead enterprise application security and DevSecOps initiatives across a strategic healthcare application portfolio. Implement automated security controls, testing, policy enforcement, and self-service capabilities in software delivery pipelines. Drive cloud, container, mobile, infrastructure-as-code, software supply chain, and vulnerability management programs using modern security platforms. Provide architecture guidance, mentor engineers, standardize security practices, lead platform implementations, and communicate security outcomes and risk posture to senior stakeholders.

The Application Security Engineer integrates security into Agile and DevSecOps processes, conducts secure code reviews, threat modeling, architecture analysis, and SAST, DAST, and SCA testing. The role develops secure coding standards, manages AppSec tooling, evaluates third-party components, guides API and cryptographic security, validates controls, documents compliance evidence, and partners with engineering, cloud, network, and cybersecurity teams. Periodic travel to test sites is required.

Build, deploy, and maintain AppSec tooling; integrate security into SDLC; triage SAST/DAST findings; automate penetration testing; lead secure coding and threat modeling; support vulnerability detection, remediation, and incident response.

Lead application security engineer responsible for designing and implementing Zero Trust application and network security across enterprise/DoD environments. Develop and troubleshoot network infrastructure, integrate security controls (firewalls, application delivery, micro-segmentation), improve reliability and availability, lead cross-functional teams, and ensure compliance with DoD/ federal security requirements. Requires Secret clearance.

Leads application security testing across the software development lifecycle, identifying vulnerabilities and secure coding weaknesses through SAST, DAST, SCA, threat modeling, penetration testing, and API assessments. Recommends remediation, communicates risks, automates security processes, and supports secure design across applications, cloud environments, vendors, and third-party solutions. Leads AI security initiatives involving LLM threat modeling and supply-chain reviews, trains developers, and monitors emerging security threats.