Scholastic DevSecOps

Application Security Engineer About the Role We are seeking an Application Security Engineer to own the triage, validation, and remediation of application and API vulnerabilities. The primary focus is findings from Wiz and our automated attack testing, including business logic flaws, authorization bypasses, and OWASP API Top 10 issues. You will confirm which findings are exploitable, determine their business impact, and work directly with developers to fix them. You will also manage our SAST and DAST programs and assess how AWS configurations affect application risk. Our core security tooling includes Wiz, Qualys, Snyk, and SonarQube. This is a hands-on security role, not a DevOps or infrastructure role.

Key Responsibilities Vulnerability Validation and Remediation

• Triage and validate findings from Wiz, Qualys, and automated and AI-driven penetration testing, reproducing exploits manually to confirm impact and eliminate false positives.
• Prioritize vulnerabilities by exploitability, data exposure, and business risk, and track them to closure.
• Write clear remediation guidance with code-level fixes, and review developer patches to confirm each fix is complete.
• Identify recurring vulnerability patterns and recommend root-cause fixes, such as shared authorization libraries or secure defaults. Application and API Testing
• Perform manual security testing of APIs and web applications, covering authentication, authorization (BOLA/IDOR, privilege escalation), session management, and injection.
• Investigate shadow and undocumented APIs surfaced by discovery tools, and assess their exposure.
• Conduct secure code reviews and threat modeling for new features and APIs. SAST and DAST Program
• Own the configuration, tuning, and operation of Snyk and SonarQube, including custom rules, quality gates, and false-positive reduction.
• Run and tune authenticated DAST scans with Qualys Web Application Scanning (WAS) against web applications and APIs.
• Correlate Snyk, SonarQube, Qualys, and Wiz findings to identify issues that are both present in code and exploitable at runtime.
• Work with development teams to integrate SAST and DAST checks into the development workflow with appropriate severity gates. AWS Security (Application Context)
• Assess how AWS configurations affect application risk, including IAM roles and policies, S3 bucket exposure, API Gateway, Lambda permissions, and secrets management.
• Validate cloud-to-application attack paths identified in Wiz, such as an exploitable API running with an over-privileged IAM role.
• Review AWS WAF rules and recommend protections for identified application vulnerability.
• Use AWS Security Hub, GuardDuty, and Inspector findings to support vulnerability investigation and prioritization. Reporting
• Report vulnerability trends, remediation SLA performance, and risk posture to engineering and security leadership. Required Qualifications
• Bachelor’s degree in information security, Computer Science, or a related field, or equivalent practical experience.
• 5+ years of experience in application security, penetration testing, or vulnerability research.
• Hands-on experience finding and exploiting business logic and access control flaws in APIs (REST, GraphQL).
• Deep working knowledge of the OWASP Top 10 and the OWASP API Security Top 10.
• Proficiency with manual testing tools such as Burp Suite Professional, including request manipulation and custom test cases.
• Hands-on experience operating and tuning SAST and DAST tools such as Snyk, SonarQube, and Qualys, including triaging their output and reducing false positives.
• Ability to read and review code in at least one modern language (for example, Python, Java, Go, or JavaScript/TypeScript).
• Working knowledge of AWS security, particularly IAM, S3, Lambda, and API Gateway, and how misconfigurations create application attack paths.
• Experience with Wiz and Qualys, or comparable CNAPP and vulnerability management platforms, with a record of turning automated scan or attack-testing output into validated, prioritized findings.
• Nice to have Hands-on experience any comparable SOAR platform, including building playbooks and integrations for vulnerability management workflows/Automating.

Preferred Qualifications

• Experience with automated or AI-assisted penetration testing and continuous DAST platforms.
• Experience writing custom rules and quality profiles in SonarQube or Snyk.
• AWS Certified Security - Specialty.
• Offensive security certifications such as OSCP, OSWE, BSCP, or GWAPT.
• Bug bounty participation or published vulnerability research.

Soft Skills

• Strong analytical skills, with the judgment to separate real, exploitable risk from scanner noise.
• Clear written communication for developer-facing remediation guidance and leadership reporting.
• Ability to influence development teams and drive fixes without direct authority.
• Self-directed and effective in a fast-paced, remote environment.