Application Security Engineer

About the role

You'll sit between security and engineering, owning application vulnerabilities from first finding to verified fix. That means separating real risk from scanner noise, telling developers exactly how to fix what matters, and making sure the same issues don't ship again.

This is a practical role. You'll read code, reproduce issues, review pull requests and work directly with development teams, not just hand over reports.

What you'll do

• Analyze and validate application security findings, confirming true positives and closing out false positives with clear reasoning
• Assess exploitability and business risk to prioritize what gets fixed first
• Give developers specific secure-code and dependency remediation guidance
• Build reusable remediation patterns so common issues get fixed the same way every time
• Review proposed fixes and supporting evidence before findings are closed
• Coordinate testing and rescanning to confirm remediation
• Support pull-request scanning, secrets detection, dependency controls and security quality gates in the CI/CD pipeline
• Track and manage findings through ServiceNow Vulnerability Response

What you'll bring

• Proven experience in application security, product security or secure software development
• Hands-on triage of SAST, SCA and vulnerability scanner output, ideally including Checkmarx and Tenable
• Strong grasp of the OWASP Top 10, CWE and CVSS, and how to translate technical severity into business risk
• Ability to read and review code in at least one mainstream language (for example Java, C#, Python, JavaScript or Go)
• Working knowledge of open-source dependency risk and remediation, including upgrade paths and breaking changes
• Experience with CI/CD security controls: PR scanning, secrets detection and build quality gates
• Comfortable working directly with developers and explaining fixes in plain terms

Nice to have

• ServiceNow Vulnerability Response experience
• Background as a software engineer before moving into security
• Experience building secure-coding standards or developer security training
• Certifications such as GWEB, CSSLP, OSWE or similar
• Hands-on triage of SAST, SCA and vulnerability scanner output, ideally including Checkmarx and Tenable
• Strong grasp of the OWASP Top 10, CWE and CVSS, and how to translate technical severity into business risk
• Ability to read and review code in at least one mainstream language (for example Java, C#, Python, JavaScript or Go)
• Working knowledge of open-source dependency risk and remediation, including upgrade paths and breaking changes
• Experience with CI/CD security controls: PR scanning, secrets detection and build quality gates
• Comfortable working directly with developers and explaining fixes in plain terms

Pay: $50.00 - $100.00 per hour

Expected hours: 40.0 per week

Work Location: Remote