Application Security Engineer

APPLICATION SECURITY ENGINEER

Java Application Security & Secure SDLC

MANIFEST Technology is seeking an experienced Application Security Engineer to join our team in partnership with our client in the Capital District, New York. The client provides comprehensive health coverage to more than 7.2 million New Yorkers. This role will strengthen application security across a large-scale, multi-tier environment by partnering with development teams, assessing risk, integrating security into the software development lifecycle, and driving timely remediation of security findings.

Type: Contract to Permanent Hire

Location: Capital District, NY

Work Arrangement : First few weeks onsite, then hybrid—Monday and Tuesday onsite, plus every other Friday; local candidates preferred

Onsite Expectations : First 3–4 weeks onsite

Salary: $100-115/year

MINIMUM QUALIFICATIONS

• Education: Bachelor’s degree in Computer Science or a related technical field, or an equivalent combination of education and experience.
• 8+ years of Information Technology experience.
• 5+ years in a software development role as a Developer or Architect.
• Java and web development experience with a strong secure coding background in RHEL and JBoss.
• 3+ years of Application Security Engineering experience conducting assessments and penetration testing, implementing dynamic and static scanning tools, consulting on application security designs and remediation, and creating training materials on key security concepts.

REQUIRED TECHNICAL / FUNCTIONAL SKILLS

• Secure Development: Strong Java and web development knowledge, secure coding practices, and experience with RHEL, JBoss, and multi-tier application architecture.
• Application Security Assessments: Experience performing risk-based technical assessments and penetration tests of applications using manual, dynamic, static, and automated techniques.
• Security Tooling: Hands-on experience implementing and using static and dynamic application security testing tools, including Fortify and SonarQube.
• Code and Architecture Review: Ability to assess new code commits, pull requests, and architecture changes for vulnerabilities, misconfigurations, and compliance risks.
• AI-Assisted Analysis: Hands-on experience integrating AI-driven code analysis platforms into CI/CD pipelines to identify vulnerabilities and insecure coding patterns before deployment.
• Risk Prioritization: Experience designing and executing repeatable processes to aggressively prioritize the disposition and remediation of security findings.
• Communication and Collaboration: Strong oral and written communication skills, with the ability to explain complex topics to technical colleagues, management, leadership, and stakeholders.
• Analysis and Problem Solving: Strong analytical, critical-thinking, teaching, and creative problem-solving abilities; skilled at gathering and analyzing information, resolving issues promptly, and developing alternative solutions.

KEY RESPONSIBILITIES

• Join the Development Team supporting a multi-tier architecture that includes service-oriented architecture, Java-based multi-tier web applications, and various commercial off-the-shelf products.
• Work closely with development teams to diagnose, document, and remediate application security vulnerabilities and identify appropriate security checkpoints throughout the software development lifecycle.
• Perform risk-based technical assessments and application penetration tests using dynamic and static scanning tools.
• Conduct audits and security reviews to support compliance with applicable industry standards.
• Review code commits, pull requests, application designs, and architecture changes for vulnerabilities, misconfigurations, and compliance risks.
• Integrate AI-driven code analysis platforms and application security tools into CI/CD pipelines to identify insecure coding patterns before deployment.
• Establish and execute a repeatable process to prioritize, disposition, track, and validate remediation of security findings.
• Provide clear, concise status updates and risk reporting to leadership and stakeholders.
• Consult with Development leadership on application security and secure development training, and create training materials on key security concepts.
• Research new attack vectors and remain current with cybersecurity news, threats, techniques, and trends.

PREFERRED QUALIFICATIONS

• CISSP, CEH, CISA, OSCP, OSCE, OSWE, or a comparable security certification.
• Experience supporting complex, large-scale, public-sector or regulated health care applications.
• Experience with service-oriented architecture and security controls across multi-tier web applications.
• Demonstrated ability to teach secure development concepts and influence cross-functional teams.

CANDIDATE RESUME GUIDANCE

• Clearly describe recent Application Security Engineering work, including the application environment, architecture, individual responsibilities, and business context.
• Provide specific examples of application assessments, penetration tests, secure code reviews, architecture reviews, vulnerabilities identified, and remediation outcomes.
• Highlight hands-on experience with Java, RHEL, JBoss, Fortify, SonarQube, CI/CD security integrations, and AI-driven code analysis platforms.
• Explain how security findings were prioritized, communicated, tracked, remediated, and validated, including leadership reporting and measurable improvements where practical.
• Distinguish individual contributions from team activities and accurately represent depth of experience with each listed technology or methodology.
• Be prepared to discuss and substantiate all experience, responsibilities, certifications, and technologies represented on the resume.

NEXT STEPS

• Qualified candidates should APPLY NOW for immediate consideration!
• Please send your resume to David Slaymaker at [email protected].