Top Application Security Engineer Jobs

Work with engineering to embed security in the SDLC: perform secure code reviews, threat modeling, vulnerability identification (SAST/DAST/SCA), validate findings, manage pen tests, coach developers on remediation, and build security awareness and training.

Lead embedding security into software delivery by partnering with engineering teams to improve CI/CD security, triage and remediate findings, design secure-by-default patterns, automate security validation and evidence generation, facilitate threat modeling, and provide reusable templates and guidance to reduce risk at scale.

Embed security into software delivery by partnering with engineering teams to improve CI/CD pipeline security, triage and remediate findings, perform threat modeling, design secure-by-default patterns, build reusable templates and automation, support compliance and audit evidence, and communicate security standards and best practices.

Operate and enhance application security tooling, author automation (Python), run and tune authenticated/unauthenticated DAST scans for web apps/APIs, validate and triage vulnerabilities using OWASP standards, track and verify remediation, ensure compliance with HIPAA/SOC II/NIST/FedRAMP, and build reporting solutions for leadership.

Review and secure application releases by analyzing source code, validating vulnerabilities, producing proof-of-concept exploits, threat modeling, improving DevSecOps pipelines (SAST/DAST/SCA/IaC), securing container runtimes, and producing clear remediation reports for engineers and executives.

Maintain and enforce cloud security standards across AWS, Azure, and GCP. Ensure cloud logging is ingested into centralized SIEM, operate CSPM tools to detect and drive remediation of misconfigurations, support incident response and risk assessments, and collaborate with engineering and security teams to enforce governance and improve cloud security posture.

Lead offensive application security work across the core product: hunt and remediate vulnerabilities, harden systems, safeguard PHI, scale AI-driven vulnerability discovery, mentor engineers, and partner with SRE and security teams to improve resilience and disaster recovery.

Lead development and maturation of the Application Security program. Maintain and integrate appsec testing platforms, review and triage scan results, produce metrics, mentor development teams, monitor CVEs, and coordinate with Audit, Governance, and Compliance to improve security posture.

Support and secure DoD enterprise architectures by designing, implementing, and administering F5 BIG-IP (LTM, APM, ASM), working in DoD IL and private clouds, configuring VMware/NSX-T micro-segmentation and SD-WAN, troubleshooting with stakeholders, and ensuring compliance with federal security standards and cryptography best practices.

Lead application security engineer responsible for designing and implementing Zero Trust application and network security across enterprise/DoD environments. Develop and troubleshoot network infrastructure, integrate security controls (firewalls, application delivery, micro-segmentation), improve reliability and availability, lead cross-functional teams, and ensure compliance with DoD/ federal security requirements. Requires Secret clearance.

Lead application security for an AI-native enterprise coaching platform: review code and architecture, threat model, perform manual pentests, build security tooling, advise DevOps on infrastructure security, support incident response and SOC processes, and handle client-facing security needs.

Perform hands-on application and system security assessments: discover and validate vulnerabilities, develop proof-of-concepts and custom tooling, conduct threat modeling and architecture reviews, and communicate clear remediation guidance to clients while contributing to security research.

Perform application security engineering and manual code/security reviews throughout the SDLC. Triage and remediate web application vulnerabilities, validate compensating controls, support incident response, and coach engineering teams on secure coding practices.

Implement and improve application security tooling across the secure software development lifecycle. Integrate security testing and controls into CI/CD pipelines, administer SAST, DAST, SCA, IAST, container, API, and supply-chain security capabilities, and support vulnerability remediation, governance, compliance reporting, and security automation. Partner with engineering and architecture teams to promote secure-by-design practices, develop security standards and documentation, and govern emerging AI-assisted development workflows.

Lead application and product security across web, mobile, API, AI/CV, and cloud-native systems. Drive secure SDLC, DevSecOps, CI/CD and supply chain security, threat modeling, tooling/automation, vulnerability remediation, and developer enablement while partnering closely with engineering teams.

Lead application security efforts end-to-end: own vulnerability management, API and supply chain security, integrate security into design reviews and CI/CD, develop automation and tooling (SAST/SCA/DAST/container/dependency), perform threat modeling, triage vulnerabilities, and support incident response and remediation across engineering teams.

Designs and executes application security practices across product and platform engineering teams. Responsibilities include integrating SAST, DAST, SCA, secret, IaC, API, mobile, container, and cloud-native security into CI/CD; conducting secure design reviews, threat modeling, code reviews, and testing; building automation, guardrails, policy-as-code, release risk gates, secure coding standards, SBOM processes, and vulnerability disclosure workflows.

Implement and maintain application security tooling (SAST/DAST/IAST/SCA/ASPM), integrate security tests into CI/CD, triage and report findings, support developers on remediation, and evangelize secure development practices across teams and cloud/container environments.

Lead implementation and administration of application security tooling (SAST/DAST/IAST/SCA/ASPM), integrate security tests into CI/CD and cloud pipelines, triage and deduplicate findings, support developers in remediation, evangelize secure development practices, and coach junior engineers.

Lead implementation and administration of application security tooling (SAST/DAST/IAST/SCA/ASPM), integrate security into CI/CD and cloud workflows, triage findings, support developers on remediation, produce security reports, evangelize secure development practices, and coach junior engineers to scale DevSecOps across the organization.

Serve as a technical AppSec expert to identify, validate, and reduce application security risk via SAST/DAST/SCA and manual testing, threat modeling, secure design reviews, CI/CD tool integration, remediation validation, and security enablement across development teams.

Build, deploy, and maintain AppSec tooling; integrate security into SDLC; triage SAST/DAST findings; automate penetration testing; lead secure coding and threat modeling; support vulnerability detection, remediation, and incident response.

Support and improve application security by implementing and operating SAST/DAST, API and container security solutions; triage and resolve security issues; collaborate with dev and product teams; participate in on-call rotation; drive projects to completion and integrate security into DevSecOps practices.

Lead AppSec across the SDLC: design and implement application security controls, perform hands-on testing of web apps/APIs/cloud services, integrate automated security tooling into CI/CD, reduce developer friction, review architecture and code, support vulnerability management and incident response, evaluate third-party risks, and ensure healthcare regulatory compliance (e.g., HIPAA, GDPR).

Implement, validate, and maintain application security controls across database, middleware, web, API, and presentation layers. Identify and remediate application-layer risks, assess internet-facing exposures, enforce auth/credentials/encryption standards, coordinate with vendors and application owners, and drive remediation using vulnerability scanning and security testing. Improve application security posture and governance across a large portfolio of commercial third‑party applications.