Top Application Security Engineer Jobs

Lead and scale ACV’s Application Security program across engineering, product, and DevOps. Establish Secure SDLC and shift-left practices; integrate security tools into CI/CD; oversee threat modeling, code reviews, assessments, and penetration testing; develop security policies, training, and automation; remediate vulnerabilities with developers; and support compliance with SOC 2, ISO 27001, and related requirements.

Supports enterprise application security by operating SAST, DAST, IAST, and IDE security tools; developing pipelines; securing web applications; troubleshooting Linux environments; and implementing enterprise security controls. The role applies OWASP and federal compliance standards, collaborates with clients and application teams, and requires experience with Veracode, Burp Suite, programming languages, and security testing tools.

Conduct manual penetration testing and vulnerability assessments across web, mobile, API, cloud, microservices, and AI/ML applications. Develop proof-of-concept exploits, identify business logic and privilege escalation flaws, research LLM-based security testing, document findings, communicate risks, and recommend remediation and AI safety controls. The role also supports threat modeling, adversarial testing, and automation research for critical enterprise applications.

Lead application security across the SDLC, partnering with engineering teams on secure architecture, coding, testing, deployment, and cloud services. Conduct manual web application and API testing, improve automated CI/CD security controls, establish secure coding standards, assess third-party risks, support vulnerability management and incident response, and ensure healthcare compliance. The role also develops enterprise-wide security policies and evaluates emerging security technologies.

Own application security across cloud services, APIs, data pipelines, and edge-deployed applications. Lead threat modeling, secure design reviews, code reviews, vulnerability assessments, and remediation. Build CI/CD security tooling, automation, and secure-by-default developer frameworks while maturing the SDLC, supply-chain security, vulnerability disclosure, and bug bounty processes. Partner with engineering and security operations, provide incident expertise, and deliver developer security training.

Secure AI and cloud-native applications by embedding controls into the Secure SDLC, CI/CD pipelines, Kubernetes environments, APIs, and software supply chains. Lead threat modeling, secure design reviews, vulnerability remediation, container hardening, runtime policy enforcement, and AI/ML workload protection. Partner with engineering teams to establish secure coding standards and improve enterprise security posture.

Lead application security engineering across the SDLC using AI-assisted threat modeling, automated security testing, vulnerability prioritization, and secure-by-default controls. Partner with Engineering, Product, QA, DevOps, and AI platform teams to secure applications, APIs, cloud infrastructure, data, and AI/ML systems. Build security automation, CI/CD controls, policy-as-code guardrails, developer enablement, and proactive defenses against emerging threats such as prompt injection and data poisoning.

Leads application security engineering across the SDLC by applying AI-assisted threat modeling, security validation, vulnerability management, and automated controls. Integrates security testing into CI/CD pipelines, develops secure-by-default patterns and policy-as-code guardrails, monitors application, cloud, API, data, and AI/ML threats, and guides remediation. Partners with Engineering, Product, QA, DevOps, and AI platform teams to improve security maturity, developer enablement, and proactive defense.

Leads application security engineering for enterprise systems, including SAST and DAST scanning, security control implementation, web application protection, and pipeline development. Uses Veracode, Burp tools, Linux, and programming or scripting languages to identify and remediate vulnerabilities. Applies OWASP, CVSS, CWE, federal compliance standards, and secure architecture practices while supporting scalable digital transformation initiatives. Requires Public Trust eligibility and U.S. citizenship.

The Security Engineer role involves identifying vulnerabilities, automating tasks in penetration testing, and creating security reports for various audiences.

Designs, implements, administers, and troubleshoots F5 BIG-IP and inline break-and-inspect proxy solutions within DoD enterprise and cloud architectures. Configures TLS and mutual TLS, applies cryptographic and PKI standards, resolves issues with DoD stakeholders, and supports secure modernization of legacy and new applications. The role requires a Secret clearance and familiarity with federal compliance standards, Linux or UNIX, networking, and cloud environments.

Owner of application-layer security across consumer flows, GraphQL APIs, and AI-driven tooling. Build and operate AppSec tooling and triage, run threat modeling and security reviews, lead HackerOne and offensive testing, automate vulnerability triage and remediation with AI agents, and partner with engineering to harden authentication, authorization, and container/cloud security.

Operates and secures application vulnerability assessment platforms in Azure and AKS. Manages Kubernetes infrastructure, container images, system administration, CI/CD pipelines, infrastructure automation, security controls, monitoring, backups, and disaster recovery. Troubleshoots application, network, database, and infrastructure issues; coordinates upgrades and change activities; maintains documentation and runbooks; and supports highly available vulnerability assessment services. Requires strong Azure, Kubernetes, DevOps, infrastructure-as-code, compliance, and technical writing expertise.

Performs application security assessments, secure code reviews, API and CMS security testing, threat modeling, vulnerability analysis, and remediation validation. Integrates SAST, DAST, dependency scanning, secrets management, and security controls into CI/CD pipelines. Advises developers and architects on secure coding, authentication, encryption, and DevSecOps practices while supporting monitoring and incident triage. Requires an active Top Secret clearance, technical bachelor’s degree, seven years of relevant experience, and Security+, CISSP, or CCSP certification.

Build and mature the application security program across the SDLC. Manage SAST, DAST, SCA, and IAST tooling; conduct penetration tests and vulnerability assessments; drive remediation; and embed Secure by Design practices. Partner with engineering on threat modeling, secure coding, architecture reviews, and CI/CD integration. Support HIPAA, NIST, and GDPR compliance through audits, reporting, documentation, policies, and cross-functional risk reduction initiatives.

Leads application and web security for global digital and commerce platforms. Manages WAF policies, CDN security, IAM, RBAC, privileged access, MFA, and identity governance. Conducts secure code reviews, penetration testing, DAST/SAST, and API security assessments. Tracks vulnerabilities, prioritizes remediation, supports SOC and SIEM workflows, and ensures compliance through secure development and operational defenses.

Own and evolve the application security program: embed secure SDLC practices, partner with engineering on design and code reviews, manage AppSec tooling (SAST/DAST/ASM/WAF/mobile), harden AWS deployments, integrate security into CI/CD, and lead vulnerability investigation and remediation efforts.

Build and maintain an AI-native application security program for autonomous trucking software and infrastructure. Partner with engineering teams on secure design and remediation, investigate vulnerabilities, threat model systems, contribute production code, develop security automation and developer tooling, and integrate preventative controls into the software development lifecycle. Use AI to scale investigations while validating results and explaining technical reasoning.

Own the organization’s application security posture, partnering with engineering and IT on secure coding, vulnerability management, penetration testing, security architecture, and remediation. Support audits, risk assessments, SOC 2 compliance, incident and breach investigations, bug bounty programs, and employee security training. The role is fully remote but requires a final in-person interview with company-paid travel.

Secure Temporal’s development pipeline, product, and customer execution environments. Partner with engineering teams on secure architecture, threat modeling, risk assessments, code and software supply-chain security, vulnerability triage, Kubernetes hardening, multi-tenant isolation, and responsible AI security. Participate in on-call rotations and help establish actionable security policies and practices across the organization.

Secure applications throughout the software development lifecycle by performing SAST, DAST, penetration testing, secure code reviews, vulnerability remediation tracking, and DoD security control validation. The role uses Fortify and SonarQube, produces assessment reports, supports secure SDLC process design, and partners with developers, architects, and cybersecurity specialists.

Secures applications throughout the software development lifecycle by performing SAST with Fortify, code analysis with SonarQube, DAST, penetration testing, secure code reviews, vulnerability remediation tracking, and DoD control validation. The role documents assessment findings, supports secure SDLC process design, and collaborates with developers, architects, and cybersecurity specialists. Requires an active Secret or TS clearance, application security experience, penetration testing knowledge, and CEH certification. Quarterly travel to Scott Air Force Base is required.

Build and lead application security for WRITER’s enterprise AI platform. Responsibilities include threat modeling, secure architecture reviews, SAST/DAST implementation, code reviews, secure coding standards, penetration testing, vulnerability remediation, and security controls for AI agents, data pipelines, and model-training environments. The role also researches emerging LLM security threats, automates security processes, and partners with engineering teams to enable secure development at scale.

Build and advance application and product security across the engineering organization. Responsibilities include establishing secure defaults, CI guardrails, security requirements, threat modeling, risk assessments, penetration testing, vulnerability remediation, secure coding education, roadmap ownership, and hands-on code review. The role partners closely with product, engineering, DevOps, and services teams to secure applications, microservices, and AI features while enabling efficient development.

Design and build security controls for METR’s AI evaluation platform, including sandboxing, isolation, networking, access boundaries, IAM, and agent permissions. Identify, triage, and remediate vulnerabilities across cloud infrastructure, codebases, and access systems. Conduct secure code reviews, harden production systems, automate provisioning and access reviews, and develop monitoring and guardrails for agentic systems.