Senior Application Security Engineer

About the Company

Dive deep into Digital! For 20 years Intellias has been developing top-tier digital solutions for the world’s leading companies, keeping them in line with the latest technology trends. Join in and provide innovations for the future!

THIS ROLE IS FOR CONTRACTORS ONLY. C2C/Independent Consultants

About the Role

What project we have for you The Application Security Engineer maintains independence from the development teams, reporting to our Cybersecurity Business Analyst, but would spend most of their time working with the Dev and DevOps teams

Their focus would be:

• Implementing and configuring SAST (static application security testing) and DAST (dynamic application security testing) across our web properties, including TOA, APIs, AFB, and the Project One stack.
• Integrating security checks into our CI/CD pipelines.
• Working with the teams to ensure secrets are handled securely and building rotation practices in line with our policies and standards.
• Helping teams understand, prioritize, and remediate the findings these tools produce.

Responsibilities

What you will do

• Select, deploy, and tune SAST tooling across our repositories, integrating scans into pull requests and CI/CD pipelines with practical quality gates.
• Implement and operate DAST scanning against our web applications and APIs in staging and production-like environments.
• Add software composition analysis and dependency scanning to track vulnerable open-source components.
• Reduce false positives and alert fatigue through rule tuning, baselining, and severity thresholds so developers trust the results and act on them.
• Recommend and implement secrets management solutions and practices that align with our existing policies and standards for storing, distributing, rotating, and auditing secrets.
• Deploy secret scanning in repositories, commit hooks, and pipelines to catch hardcoded credentials before they ship, and partner with DevOps to remove long-lived credentials from pipelines, configurations, and infrastructure-as-code.
• Lead the response when secrets are exposed: revoke, rotate, assess impact, and fix the root cause.
• Triage findings from scanners, penetration tests, external reports, and internal reviews, prioritizing by exploitability, exposure, and business impact rather than raw severity scores.
• Work directly with developers and DevOps engineers to understand root causes, propose practical fixes, and agree on realistic remediation timelines.
• Track findings to closure in the teams’ existing workflow tools, and define and enforce remediation SLAs by severity.
• Identify recurring vulnerability patterns and address them at the source through shared libraries, secure defaults, and pipeline guardrails.
• Perform manual code reviews and targeted security testing on high-risk features such as authentication, file uploads, and APIs.
• Provide clear, actionable remediation guidance with code-level examples, and contribute to secure coding standards aligned to OWASP Top 10 and ASVS.
• Participate in design and architecture discussions to provide security input and threat modeling for new features and services.
• Build the roadmap, processes, and tooling strategy for a new application security function, including build-versus-buy recommendations and vendor evaluations.
• Define and report application security metrics to security leadership, such as scan coverage, mean time to remediate, and open critical and high findings.
• Support audit and compliance requirements related to secure development, and contribute to incident response for application-layer security events.

Qualifications

What you need for this

• Required Qualifications
• BA/BS in Computer Science, Information Technology, Cybersecurity, or a related field, with 5+ years of experience in application security, product security, or a security-focused engineering role, or equivalent practical experience.
• Hands-on experience deploying and operating SAST and DAST tools in CI/CD pipelines, including tuning them for accuracy.
• Experience implementing secrets management and secret scanning in a production environment.
• Strong knowledge of web application vulnerabilities (OWASP Top 10, CWE Top 25) and how to remediate them in code.
• Working knowledge of authentication and identity management workflows and protocols (e.g., SAML, OAuth 2.0, OpenID Connect, SSO, session management) and the common security flaws in how they are implemented.
• Ability to read and review code in at least one modern language (e.g., Python, JavaScript/TypeScript, Java, C#, Go).
• Working knowledge of CI/CD platforms (e.g., GitHub Actions, GitLab CI, Jenkins) and DevOps practices.
• Demonstrated experience working with developers to fix security issues, not just report them.

Required Skills

• Hands-on experience deploying and operating SAST and DAST tools in CI/CD pipelines, including tuning them for accuracy.
• Experience implementing secrets management and secret scanning in a production environment.
• Strong knowledge of web application vulnerabilities (OWASP Top 10, CWE Top 25) and how to remediate them in code.
• Working knowledge of authentication and identity management workflows and protocols (e.g., SAML, OAuth 2.0, OpenID Connect, SSO, session management) and the common security flaws in how they are implemented.
• Ability to read and review code in at least one modern language (e.g., Python, JavaScript/TypeScript, Java, C#, Go).
• Working knowledge of CI/CD platforms (e.g., GitHub Actions, GitLab CI, Jenkins) and DevOps practices.
• Demonstrated experience working with developers to fix security issues, not just report them.

Preferred Skills

• Preferred Qualifications
• Experience building or significantly maturing an application security program from scratch.
• Experience with threat modeling methodologies such as STRIDE or PASTA.
• Experience with cloud and container security (e.g., Microsoft Azure, AWS, or GCP; Docker and Kubernetes).
• Experience with infrastructure-as-code security scanning and API security testing.
• Experience evaluating security tooling, including build-versus-buy decisions.