Top Application Security Engineer Jobs

The Security Engineer role involves identifying vulnerabilities, automating tasks in penetration testing, and creating security reports for various audiences.

Designs, implements, administers, and troubleshoots F5 BIG-IP and inline break-and-inspect proxy solutions within DoD enterprise and cloud architectures. Configures TLS and mutual TLS, applies cryptographic and PKI standards, resolves issues with DoD stakeholders, and supports secure modernization of legacy and new applications. The role requires a Secret clearance and familiarity with federal compliance standards, Linux or UNIX, networking, and cloud environments.

Lead and improve the Secure SDLC across software, firmware, cloud, and AI-enabled environments. Conduct application and architecture reviews, threat modeling, source code assessments, vulnerability management, and penetration testing support. Define secure coding standards and security gates, implement DevSecOps controls including SAST, DAST, SCA, secrets scanning, and container security, and automate security testing. Partner with engineering and DevOps teams, mentor developers, and drive security-by-design practices.

Designs and implements application security protections for APIs, services, developer tools, and data platforms supporting autonomous vehicle and software infrastructure. Responsibilities include threat modeling, code and architecture reviews, authentication and authorization controls, secure handling of credentials and sensitive data, CI/CD security integration, vulnerability remediation, and reusable security tooling. The role partners with software, infrastructure, and corporate security teams to prioritize and measure security improvements.

Owner of application-layer security across consumer flows, GraphQL APIs, and AI-driven tooling. Build and operate AppSec tooling and triage, run threat modeling and security reviews, lead HackerOne and offensive testing, automate vulnerability triage and remediation with AI agents, and partner with engineering to harden authentication, authorization, and container/cloud security.

Manage and mature vulnerability management across applications, networks, endpoints, cloud platforms, and enterprise systems. Identify, prioritize, and mitigate vulnerabilities; support patching, hardening, incident response, and risk reduction. Collaborate with ISSOs, assessors, developers, and security stakeholders to validate RMF artifacts, refine control statements, support NIST, FISMA, and SOX compliance, and improve Authority to Operate readiness through repeatable workflows and accurate assessment documentation.

Designs and maintains application security capabilities across the software development lifecycle. Responsibilities include operating SAST, DAST, software composition analysis, and secrets-scanning tools; threat modeling; secure design and code reviews; vulnerability remediation; penetration testing; developer education; API, cloud, container, and software supply chain security; incident response; risk assessments; and application security program improvement.

Operates and secures application vulnerability assessment platforms in Azure and AKS. Manages Kubernetes infrastructure, container images, system administration, CI/CD pipelines, infrastructure automation, security controls, monitoring, backups, and disaster recovery. Troubleshoots application, network, database, and infrastructure issues; coordinates upgrades and change activities; maintains documentation and runbooks; and supports highly available vulnerability assessment services. Requires strong Azure, Kubernetes, DevOps, infrastructure-as-code, compliance, and technical writing expertise.

Performs application security assessments, secure code reviews, API and CMS security testing, threat modeling, vulnerability analysis, and remediation validation. Integrates SAST, DAST, dependency scanning, secrets management, and security controls into CI/CD pipelines. Advises developers and architects on secure coding, authentication, encryption, and DevSecOps practices while supporting monitoring and incident triage. Requires an active Top Secret clearance, technical bachelor’s degree, seven years of relevant experience, and Security+, CISSP, or CCSP certification.

Build and mature the application security program across the SDLC. Manage SAST, DAST, SCA, and IAST tooling; conduct penetration tests and vulnerability assessments; drive remediation; and embed Secure by Design practices. Partner with engineering on threat modeling, secure coding, architecture reviews, and CI/CD integration. Support HIPAA, NIST, and GDPR compliance through audits, reporting, documentation, policies, and cross-functional risk reduction initiatives.

Leads application and web security for global digital and commerce platforms. Manages WAF policies, CDN security, IAM, RBAC, privileged access, MFA, and identity governance. Conducts secure code reviews, penetration testing, DAST/SAST, and API security assessments. Tracks vulnerabilities, prioritizes remediation, supports SOC and SIEM workflows, and ensures compliance through secure development and operational defenses.

Lead application security strategy and DevSecOps implementation across engineering teams. Own application security capabilities, including SAST, SCA, DAST, API security testing, vulnerability management, and CI/CD controls. Lead API security discovery, testing, onboarding, findings routing, and operational readiness. Partner with product, engineering, DevOps, infrastructure, IAM, and enterprise security teams to identify architectural weaknesses, improve SDLC adoption, automate abuse-case coverage, and operate hardened platforms.

Own and evolve the application security program: embed secure SDLC practices, partner with engineering on design and code reviews, manage AppSec tooling (SAST/DAST/ASM/WAF/mobile), harden AWS deployments, integrate security into CI/CD, and lead vulnerability investigation and remediation efforts.

Build and maintain an AI-native application security program for autonomous trucking software and infrastructure. Partner with engineering teams on secure design and remediation, investigate vulnerabilities, threat model systems, contribute production code, develop security automation and developer tooling, and integrate preventative controls into the software development lifecycle. Use AI to scale investigations while validating results and explaining technical reasoning.

Own the organization’s application security posture, partnering with engineering and IT on secure coding, vulnerability management, penetration testing, security architecture, and remediation. Support audits, risk assessments, SOC 2 compliance, incident and breach investigations, bug bounty programs, and employee security training. The role is fully remote but requires a final in-person interview with company-paid travel.

Secure Temporal’s development pipeline, product, and customer execution environments. Partner with engineering teams on secure architecture, threat modeling, risk assessments, code and software supply-chain security, vulnerability triage, Kubernetes hardening, multi-tenant isolation, and responsible AI security. Participate in on-call rotations and help establish actionable security policies and practices across the organization.

Implements and administers application security testing and posture management tools, integrates security testing into CI/CD pipelines, and supports developers in triaging and remediating vulnerabilities. Develops security reports, evaluates exceptions, communicates risks, promotes secure coding practices, and coaches junior engineers. The role also supports tooling consolidation, workflow automation, CSPM integration, DevSecOps pipeline logging, and collaboration with vulnerability and risk management teams.

Secure applications throughout the software development lifecycle by performing SAST, DAST, penetration testing, secure code reviews, vulnerability remediation tracking, and DoD security control validation. The role uses Fortify and SonarQube, produces assessment reports, supports secure SDLC process design, and partners with developers, architects, and cybersecurity specialists.

Secures applications throughout the software development lifecycle by performing SAST with Fortify, code analysis with SonarQube, DAST, penetration testing, secure code reviews, vulnerability remediation tracking, and DoD control validation. The role documents assessment findings, supports secure SDLC process design, and collaborates with developers, architects, and cybersecurity specialists. Requires an active Secret or TS clearance, application security experience, penetration testing knowledge, and CEH certification. Quarterly travel to Scott Air Force Base is required.

Build and lead application security for WRITER’s enterprise AI platform. Responsibilities include threat modeling, secure architecture reviews, SAST/DAST implementation, code reviews, secure coding standards, penetration testing, vulnerability remediation, and security controls for AI agents, data pipelines, and model-training environments. The role also researches emerging LLM security threats, automates security processes, and partners with engineering teams to enable secure development at scale.

Lead AppSec efforts across product, platform, and AI features by owning secure SDLC, performing threat modeling and deep code reviews, driving vulnerability management and remediation, building AppSec tooling and automations (including AI-assisted workflows), and enabling engineering teams with secure design guidance and training.

Responsible for maintaining and implementing SAP software applications, managing security configurations, and providing application support and testing.

Build and advance application and product security across the engineering organization. Responsibilities include establishing secure defaults, CI guardrails, security requirements, threat modeling, risk assessments, penetration testing, vulnerability remediation, secure coding education, roadmap ownership, and hands-on code review. The role partners closely with product, engineering, DevOps, and services teams to secure applications, microservices, and AI features while enabling efficient development.

Design and build security controls for METR’s AI evaluation platform, including sandboxing, isolation, networking, access boundaries, IAM, and agent permissions. Identify, triage, and remediate vulnerabilities across cloud infrastructure, codebases, and access systems. Conduct secure code reviews, harden production systems, automate provisioning and access reviews, and develop monitoring and guardrails for agentic systems.

The Senior Application Security Engineer ensures the security of systems and data by monitoring vulnerabilities, responding to incidents, and promoting security best practices within the organization.