Lead Application Security Engineer – DevSecOps

Job Description:

• Socialize and drive execution of key security best practices across the R&D organization
• Contribute to the enterprise security catalog of best practices, techniques, and patterns
• Improve the quality and adoption of Security Development Lifecycle practices
• Own the evaluation, design, implementation, integration, reliability, and continuous improvement of application security capabilities
• Support SAST, SCA, DAST, API security testing, and vulnerability management workflows
• Document, share, and help automate coverage for common abuse cases and attacks
• Lead the API security testing program
• Manage API discovery, authenticated and unauthenticated testing, scanner attribution, onboarding, exclusions, ownership mapping, findings routing, and operational readiness
• Identify and explain feature-level design or architectural weaknesses that could create security issues
• Partner with enterprise security leadership to track and prioritize open issues and follow through on resolution
• Work with DevOps, Infrastructure, IAM, API Gateway, NOC, Enterprise Security, and application teams to design and operate security-hardened platforms
• Set technical strategy, influence stakeholders, and define measurable security outcomes

Requirements:

• Bachelor’s degree in Computer Science, Computer Engineering, Cyber Security, or similar, or equivalent experience
• At least 3 years of experience as a software developer
• 3–5 years in a security-focused development role in an agile environment
• Experience in software and product design and architecture, product security, and security issue prevention and mitigation
• Strong software engineering background
• Ability to develop, review, and troubleshoot code in one or more languages
• Practical experience with Docker and Terraform
• Strong knowledge of OAuth 2.0, OpenID Connect, JWT, SAML, and service-to-service authentication
• Solid understanding of RESTful services, service bus architectures, JSON, and related web services concepts
• Experience with SAST, SCA, DAST, API security testing, vulnerability aggregation, and CI/CD security controls
• Hands-on experience with cloud platforms, containers, infrastructure as code, secrets management, and CI/CD
• Knowledge of HIPAA, HITRUST, and PCI-DSS is a plus

Benefits:

• Health and financial benefits
• Commuter support
• Employee assistance programs
• Tuition assistance
• Employee resource groups
• Collaborative workspaces
• Flexible work arrangements and work-life balance support
• Company events including book clubs, external speakers, and hackathons
• Learning-focused company culture
• Engaged team support
• Inclusive environment
• Annual discretionary bonus plan, variable compensation plan, and equity plans (depending on role eligibility)