Senior Application Security Engineer
New
G
GuidePoint SecurityCybersecurity
Applicants must be authorized to work for any employer in the U.S.Full-TimeSenior
Salary not disclosed
Apply NowOpens the employer's application page
Job Details
- Experience
- 4–8+ years of experience in Application Security, Web Penetration Testing, DevSecOps, or agentic software development with a security focus
- Required Skills
- CI/CD
Requirements
- Have 4–8+ years of experience in Application Security, Web Penetration Testing, DevSecOps, or agentic software development with a security focus.
- Demonstrate proficiency with manual testing tools such as Burp Suite Pro.
- Understand the OWASP Top 10 and OWASP API Security Top 10 and their mitigation strategies.
- Know secure development lifecycles and have experience guiding remediation of vulnerabilities identified by application security tools.
- Be able to review source code in one or more of JavaScript/TypeScript, Python, Java, C#, Go, PHP, or C/C++.
- Have working knowledge of AWS, Azure, or GCP, containers, and Git-based development workflows.
- Communicate complex problems clearly to technical and executive audiences.
- Preferred: experience building agentic AI workflows or automation using Python, Bash, or PowerShell.
- Preferred: experience with SBOM, SLSA, Sigstore, and IaC or container security scanning tools such as Checkov, Trivy, or Wiz.
- Preferred: experience with threat modeling methodologies such as STRIDE and AppSec maturity frameworks such as OWASP SAMM, BSIMM, or NIST SSDF.
- Preferred: certifications such as GWAPT, OSWE, OSCP, CSSLP, CDP, or AWS Certified Security – Specialty.
- Preferred: a bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent experience.
- Travel up to 10%.
Responsibilities
- Run and tune client SAST, DAST, SCA, secrets, and IaC scanning tools; triage results, eliminate false positives, and provide prioritized remediation guidance.
- Integrate security tools into CI/CD pipelines, source control, IDEs, and ticketing systems, including policy gates and break-the-build criteria.
- Partner with development teams on remediation, secure coding guidance, and developer enablement throughout the SDLC.
- Assess software supply chain controls, including SBOM generation, dependency and container image scanning, artifact signing, and pipeline and runner security.
- Perform threat modeling and security architecture reviews for cloud-native, microservice, container, and Infrastructure-as-Code environments.
- Use AI-assisted and agentic tooling to accelerate testing and reporting, and advise clients on securely adopting AI coding assistants.
- Define AppSec program metrics, vulnerability management SLAs, and roadmaps aligned to frameworks such as OWASP SAMM, BSIMM, and NIST SSDF.
- Produce client-ready deliverables, present findings to technical and executive audiences, and contribute to AppSec practice tooling, methodologies, and knowledge sharing.
View Full Description & ApplyYou'll be redirected to the employer's site
