Top Application Security Engineer Jobs

Supports application security through threat modeling, risk assessments, vulnerability triage and remediation, security scanning, developer training, investigations, and implementation of security controls. Partners with development and senior security teams to protect cloud-first infrastructure using AWS, Kubernetes, and related technologies while developing secure coding and SDLC expertise.

Leads enterprise application security through secure code reviews, threat modeling, architecture assessments, CI/CD security controls, secure coding standards, API protections, WAF tuning, and software supply chain security. Partners with engineering, DevOps, platform, and SRE teams to remediate risks, automate controls, secure AI-enabled applications, and improve organization-wide security practices. Serves as a principal technical advisor and mentor while defining scalable guardrails, playbooks, metrics, and reference architectures.

Lead application security engineering across the SDLC using AI-assisted threat modeling, automated security testing, vulnerability prioritization, and secure-by-default controls. Partner with Engineering, Product, QA, DevOps, and AI platform teams to secure applications, APIs, cloud infrastructure, data, and AI/ML systems. Build security automation, CI/CD controls, policy-as-code guardrails, developer enablement, and proactive defenses against emerging threats such as prompt injection and data poisoning.

Leads application security engineering across the SDLC by applying AI-assisted threat modeling, security validation, vulnerability management, and automated controls. Integrates security testing into CI/CD pipelines, develops secure-by-default patterns and policy-as-code guardrails, monitors application, cloud, API, data, and AI/ML threats, and guides remediation. Partners with Engineering, Product, QA, DevOps, and AI platform teams to improve security maturity, developer enablement, and proactive defense.

Sets application security direction and standards across engineering teams. Builds scalable security tooling, automation, and observability; leads threat modeling, risk assessments, code reviews, and multi-team remediation. Develops strategies for AI-powered systems and agentic development risks, API security, and software supply chain security. Partners with engineering and security teams, prioritizes investments, communicates risk to leadership, and mentors AppSec engineers.

The Security Engineer role involves identifying vulnerabilities, automating tasks in penetration testing, and creating security reports for various audiences.

Owner of application-layer security across consumer flows, GraphQL APIs, and AI-driven tooling. Build and operate AppSec tooling and triage, run threat modeling and security reviews, lead HackerOne and offensive testing, automate vulnerability triage and remediation with AI agents, and partner with engineering to harden authentication, authorization, and container/cloud security.

Build and scale enterprise application security capabilities: design automations, integrations, developer tooling, golden paths, and secure AI guardrails. Secure code, dependencies, containers, IaC, CI/CD, and software supply chains; improve vulnerability triage, remediation, telemetry, and platform integrations while mentoring engineers and partnering with cloud and platform teams.

Partner with engineering, compliance, and security teams to embed application security into the SDLC: triage static/SCA alerts, advise on OWASP Top 10 remediation, maintain developer playbooks and training, track security metrics and evidence for audits, and help shape AI governance and GenAI-safe workflows.

Own and evolve the application security program: embed secure SDLC practices, partner with engineering on design and code reviews, manage AppSec tooling (SAST/DAST/ASM/WAF/mobile), harden AWS deployments, integrate security into CI/CD, and lead vulnerability investigation and remediation efforts.

Embed security throughout the software development lifecycle by partnering with engineering teams, designing secure systems, conducting code reviews, identifying vulnerabilities, and reducing application risk. The role requires expertise in OWASP vulnerabilities, SAST, DAST, SCA, CI/CD security tooling, cloud security, authentication, authorization, cryptography, and security automation. Responsibilities also include communicating with technical and non-technical stakeholders and supporting secure software delivery in an Agile environment.

Lead AppSec efforts across product, platform, and AI features by owning secure SDLC, performing threat modeling and deep code reviews, driving vulnerability management and remediation, building AppSec tooling and automations (including AI-assisted workflows), and enabling engineering teams with secure design guidance and training.

Responsible for maintaining and implementing SAP software applications, managing security configurations, and providing application support and testing.

Lead application security assessments across New York City agencies by operating SAST, DAST, and SCA platforms, validating vulnerabilities through manual testing and exploit reproduction, providing remediation and secure coding guidance, identifying systemic weaknesses, mentoring assessment staff, and producing technical and executive security reports.

Lead penetration testing and vulnerability remediation for web, mobile, and medical device applications, ensuring compliance with healthcare regulations.

Architect and build automated application security layers across the SDLC for a large financial services program. Integrate and tune SAST, DAST, and SCA tools within enterprise CI/CD pipelines, develop AI-enabled secure code scanning and hardened baselines, automate secure coding patterns and runbooks, and provide code-level remediation guidance for Java and Python applications.

Build and advance application and product security across the engineering organization. Responsibilities include establishing secure defaults, CI guardrails, security requirements, threat modeling, risk assessments, penetration testing, vulnerability remediation, secure coding education, roadmap ownership, and hands-on code review. The role partners closely with product, engineering, DevOps, and services teams to secure applications, microservices, and AI features while enabling efficient development.

Lead integration of security across the SDLC: implement and assess Secure SDLC and app/product security programs, perform architecture reviews, threat modeling, and security assessments, advise on software supply chain and tooling (SAST/DAST/SCA/IaC), mentor team members, and translate technical risks into executive briefings and actionable roadmaps.

As a Security Engineer, you will conduct security assessments, develop security tools, perform architecture reviews, and collaborate on advanced security research.

Embed security throughout the software development lifecycle through threat modeling, architecture reviews, code reviews, vulnerability management, security tooling, red-team exercises, runtime protections, secure authentication and cryptography, cloud and container hardening, incident response, training, and technical documentation. The role partners closely with engineering teams to deliver secure software and reduce application risk.

Designs, implements, and administers F5 BIG-IP and proxy-based security solutions within DoD enterprise and cloud architectures. Troubleshoots TLS and mutual TLS, supports AWS cloud environments, and works with DoD clients and stakeholders on enterprise architecture issues. Applies knowledge of cryptography, PKI, hashing, networking, federal compliance standards, and Linux or UNIX systems. Requires Secret clearance and at least a high school diploma or GED.

Designs, implements, administers, and troubleshoots F5 BIG-IP and inline break-and-inspect proxy solutions within DoD enterprise and cloud architectures. Configures TLS and mutual TLS, applies cryptographic and PKI standards, resolves issues with DoD stakeholders, and supports secure modernization of legacy and new applications. The role requires a Secret clearance and familiarity with federal compliance standards, Linux or UNIX, networking, and cloud environments.

Designs, implements, and administers F5 BIG-IP and proxy-based break-and-inspect solutions within DoD enterprise and cloud architectures. Troubleshoots TLS and mutual TLS configurations, supports AWS and hybrid cloud environments, and resolves architecture issues with DoD clients and stakeholders. Applies knowledge of cryptography, PKI, federal compliance standards, Linux or UNIX systems, and networking protocols while supporting national security missions.

Leads application and data security engineering across cloud, on-premises, and colocation environments. Develops security policies, standards, testing, vulnerability analysis, WAF and Layer 7 protections, and secure software development practices. Supports incident response and on-call operations, researches emerging threats, mentors engineers, and contributes to security strategy, risk assessments, compliance, and roadmap planning.

Operate application security across the SDLC, including secure design, code reviews, threat modeling, API security, DevSecOps tooling, CI/CD security gates, cloud and container security, vulnerability management, and risk communication. Partner with engineering teams on secure coding standards, AWS, Kubernetes, Terraform, mobile ecosystems, and responsible AI integration. Participate in an on-call rotation and develop scalable security platforms, paved roads, documentation, and developer training.