Top Application Security Engineer Jobs

Leads Samsara’s application security and vulnerability management programs across cloud, firmware, IoT, and corporate systems. Responsibilities include setting technical strategy, reducing remediation time, developing automation, guiding engineering teams, mentoring security engineers, assessing high-profile vulnerabilities, supporting incident investigations, and participating in on-call response. The role requires extensive security experience, programming proficiency, AWS expertise, vulnerability management knowledge, and practical use of AI/LLM tooling.

Embed security across the SDLC by integrating and automating SAST/DAST/SCA and supply-chain protections, operating and tuning vulnerability management tooling, conducting threat modeling and security/code reviews, partnering with engineering and product teams to remediate risks, and safely applying AI/ML to improve security automation and triage.

Secure ServiceNow instances by assessing configurations against security baselines, identifying misconfigurations, validating customer-reported findings, and providing actionable remediation guidance. The role develops hardening guidance, distinguishes product vulnerabilities from configuration issues, partners with Product Security and Engineering, supports customer escalations, and drives scalable improvements to security tooling, detection, and risk-reduction processes.

Drive application security by running SAST/SCA, threat modeling, vulnerability management, and remediation. Advise on secure architecture, train engineers, support pentests/bug bounties, and administer AWS Control Tower and IAM. Innovate with AI to improve AppSec tooling and practices.

Conduct manual penetration tests and secure code reviews across web applications, APIs, AWS infrastructure, and AI systems. Develop AI-assisted security tooling, test LLM applications and agents, triage SAST findings, tune detection rules, support security reviews before production, and communicate risks and remediation priorities to engineering teams.

Build and scale application security for a SaaS platform by integrating SAST, SCA, DAST, secrets scanning, and container/IaC checks into CI/CD. Partner with engineering and DevOps teams on threat modeling, secure code reviews, vulnerability remediation, incident response, and secure development practices. The role also supports compliance goals and translates security risks clearly to engineers.

Partner with product, platform, and infrastructure teams to embed security into products and AWS cloud architecture. Conduct application security assessments, code reviews, threat modeling, penetration tests, red-team exercises, and vulnerability remediation. Assess AI and agentic AI capabilities, investigate security findings and customer concerns, support incident response, monitor threat intelligence, and automate security processes. Occasional on-call participation may be required.

Supports application security through threat modeling, risk assessments, vulnerability triage and remediation, security scanning, developer training, investigations, and implementation of security controls. Partners with development and senior security teams to protect cloud-first infrastructure using AWS, Kubernetes, and related technologies while developing secure coding and SDLC expertise.

Lead application security engineering across the SDLC using AI-assisted threat modeling, automated security testing, vulnerability prioritization, and secure-by-default controls. Partner with Engineering, Product, QA, DevOps, and AI platform teams to secure applications, APIs, cloud infrastructure, data, and AI/ML systems. Build security automation, CI/CD controls, policy-as-code guardrails, developer enablement, and proactive defenses against emerging threats such as prompt injection and data poisoning.

Leads application security engineering across the SDLC by applying AI-assisted threat modeling, security validation, vulnerability management, and automated controls. Integrates security testing into CI/CD pipelines, develops secure-by-default patterns and policy-as-code guardrails, monitors application, cloud, API, data, and AI/ML threats, and guides remediation. Partners with Engineering, Product, QA, DevOps, and AI platform teams to improve security maturity, developer enablement, and proactive defense.

Sets application security direction and standards across engineering teams. Builds scalable security tooling, automation, and observability; leads threat modeling, risk assessments, code reviews, and multi-team remediation. Develops strategies for AI-powered systems and agentic development risks, API security, and software supply chain security. Partners with engineering and security teams, prioritizes investments, communicates risk to leadership, and mentors AppSec engineers.

The Security Engineer role involves identifying vulnerabilities, automating tasks in penetration testing, and creating security reports for various audiences.

Conduct web, mobile, and API penetration testing using manual techniques and automated DAST tools. Configure scanners, analyze and validate findings, triage false positives, and produce technical reports. Collaborate with development and security teams on remediation, improve testing methodologies, and conduct peer reviews. Apply AI-enhanced security tools while accounting for model limitations, security risks, privacy, compliance, and ethical standards.

Conduct penetration testing of web, mobile, and API applications using manual techniques and automated or AI-enhanced tools. Configure scanners, analyze and validate findings, triage false positives, document vulnerabilities, and collaborate with development and security teams on remediation. Improve testing methodologies, perform peer reviews, communicate with stakeholders, and ensure AI-assisted security work addresses compliance, privacy, ethical, and operational risks.

Conduct penetration testing of web, mobile, and API applications using manual techniques and automated DAST tools. Configure scanners, analyze and validate findings, triage false positives, document vulnerabilities, and collaborate with development and security teams on remediation. Apply AI-enhanced security tools responsibly while accounting for model limitations, privacy, compliance, and ethical considerations. Contribute to testing methodology improvements, peer reviews, stakeholder communication, and knowledge sharing.

Conduct penetration testing of web, mobile, and API applications using manual techniques and automated DAST tools. Analyze and validate vulnerabilities, triage false positives, produce technical reports, and collaborate with development and security teams on remediation. Configure scanners, apply AI-assisted security analysis responsibly, improve testing methodologies, and communicate findings to stakeholders while maintaining compliance with security, privacy, and ethical standards.

Owner of application-layer security across consumer flows, GraphQL APIs, and AI-driven tooling. Build and operate AppSec tooling and triage, run threat modeling and security reviews, lead HackerOne and offensive testing, automate vulnerability triage and remediation with AI agents, and partner with engineering to harden authentication, authorization, and container/cloud security.

Own and implement application security across the software development lifecycle for multiple product lines. Define security controls, validation gates, standards, and guardrails; conduct architecture reviews; enhance CI/CD security; triage SAST, SCA, and penetration-testing findings; support incident response; maintain FedRAMP and CJIS compliance; and represent security practices in audits and customer engagements.

Build and scale enterprise application security capabilities: design automations, integrations, developer tooling, golden paths, and secure AI guardrails. Secure code, dependencies, containers, IaC, CI/CD, and software supply chains; improve vulnerability triage, remediation, telemetry, and platform integrations while mentoring engineers and partnering with cloud and platform teams.

Performs application security assessments, secure code reviews, API and CMS security testing, threat modeling, vulnerability analysis, and remediation validation. Integrates SAST, DAST, dependency scanning, secrets management, and security controls into CI/CD pipelines. Advises developers and architects on secure coding, authentication, encryption, and DevSecOps practices while supporting monitoring and incident triage. Requires an active Top Secret clearance, technical bachelor’s degree, seven years of relevant experience, and Security+, CISSP, or CCSP certification.

The Application Security Engineer embeds security throughout the software development lifecycle. Responsibilities include threat modeling, security architecture reviews, manual code reviews, security tooling across CI/CD pipelines, vulnerability management, red-team exercises, runtime protection, authentication and cryptographic controls, cloud and Kubernetes hardening, security training, incident response, and technical documentation. The role partners closely with engineering teams to reduce application risk and improve secure development practices.

Build and mature the application security program across the SDLC. Manage SAST, DAST, SCA, and IAST tooling; conduct penetration tests and vulnerability assessments; drive remediation; and embed Secure by Design practices. Partner with engineering on threat modeling, secure coding, architecture reviews, and CI/CD integration. Support HIPAA, NIST, and GDPR compliance through audits, reporting, documentation, policies, and cross-functional risk reduction initiatives.

Lead application security strategy and DevSecOps implementation across engineering teams. Own application security capabilities, including SAST, SCA, DAST, API security testing, vulnerability management, and CI/CD controls. Lead API security discovery, testing, onboarding, findings routing, and operational readiness. Partner with product, engineering, DevOps, infrastructure, IAM, and enterprise security teams to identify architectural weaknesses, improve SDLC adoption, automate abuse-case coverage, and operate hardened platforms.

Embed security throughout the software development lifecycle by partnering with engineering teams, designing secure systems, conducting code reviews, identifying vulnerabilities, integrating security tooling, and reducing application risk. The role requires hands-on offensive and defensive security expertise, cloud security knowledge, programming ability, and strong communication skills. Preferred experience includes security certifications, red-team operations, bug bounties, public CVEs, AI/LLM security, and regulated industries.

Partner with engineering, compliance, and security teams to embed application security into the SDLC: triage static/SCA alerts, advise on OWASP Top 10 remediation, maintain developer playbooks and training, track security metrics and evidence for audits, and help shape AI governance and GenAI-safe workflows.