Application Security Engineer

Job Summary

The Application Security Engineer will drive the development and operationalization of Malcode and CBOM capabilities, focusing on security assessment, risk validation, remediation guidance, and automation to strengthen application security posture.

Responsibilities

Security Engineering & Development

Develop and enhance Malcode and CBOM capabilities to improve security detection and response

Implement workflow automation and process improvements to increase efficiency and reduce manual effort

Integrate security tools, repositories, and supporting platforms to streamline security operations

Enhance analysis and reporting capabilities to provide actionable security insights

Security Assessment & Remediation

Analyze security findings for exploitability, severity, and business impact to prioritize risks

Review source code, logs, and technical artifacts to identify vulnerabilities

Identify false positives and duplicate findings to ensure accurate vulnerability tracking

Validate remediation activities and conduct retesting to confirm issue resolution

Provide remediation guidance to application teams to support secure development practices

Governance & Operations

Manage vulnerability and finding lifecycle processes to maintain security oversight

Track remediation progress and risk disposition to ensure timely risk mitigation

Produce operational and management reports to inform stakeholders

Support governance reviews and stakeholder engagements to align security efforts with business objectives

Required competencies and certifications

Application Security Testing (SAST, DAST, SCA) applied to identify and assess vulnerabilities

Software Composition Analysis and dependency risk management to secure third-party components

Secure SDLC practices to embed security throughout the development lifecycle

Source code review and vulnerability assessment to detect security flaws

Automation and scripting (Python, PowerShell, or similar) to enhance security workflows

Security reporting and analytics to deliver meaningful security metrics and insights

Preferred competencies and qualifications

CEH, GWAPT, CSSLP, OSCP, or equivalent certifications demonstrating professional security expertise

Experience with SBOM/CBOM, malware analysis, and software supply-chain security to address emerging threats

Prior experience in enterprise-scale application security programs to manage complex security environments