[Remote] Application Security Engineer

Note: The job is a remote job and is open to candidates in USA. Everus is a specialty contractor focused on safely building America’s future. The Application Security Engineer will build, operate, and continuously improve application security tooling and code review practices across the software development lifecycle, including controls for AI-assisted coding. The role partners closely with developers on security remediation, vulnerability operations, threat modeling, and secure cloud application architecture.

Responsibilities

• Deploy, integrate, and tune SAST, DAST, SCA, IaC, container, and secrets-scanning tooling across our CI/CD pipelines (GitHub Actions, Azure DevOps)
• Write and maintain custom rules (Semgrep, CodeQL, or equivalent) tailored to our codebases and the recurring issues we actually see
• Build security gates, pre-commit hooks, and PR automation that catch issues early without breaking developer flow
• Develop and maintain SBOM generation and dependency-update automation (Dependabot, Renovate, or custom)
• Automate secret rotation and detection workflows, including post-leak revocation paths
• Build dashboards and metrics on findings, MTTR, coverage, and pipeline health
• Create secure-by-default project templates, starter repos, and reusable workflows for our development teams
• Continuously evaluate and replace tooling — we expect this stack to evolve
• Perform manual security code reviews on high-risk changes, new applications, and pre-production releases
• Conduct lightweight threat modeling on new applications and major changes — focused on producing actionable findings, not artifacts
• Pair with developers on remediation, including writing the fix when that's the fastest path
• Review architecture for in-house applications, integrations, and Azure-hosted workloads (App Service, Functions, Key Vault, Storage, AI services)
• Triage, validate, and route findings from automated scanners and external researchers
• Maintain reusable secure-coding patterns and code samples developers can copy
• Build technical guardrails around AI coding tool usage in our repositories — what gets allowed, what gets flagged, what gets blocked
• Implement detection for common AI-generated insecurity patterns (insecure deserialization, missing authz, hardcoded secrets, weak crypto, prompt-injection-prone patterns in agentic code)
• Stand up telemetry to attribute and assess AI-generated code, especially in SOX-relevant systems
• Build automated PR review tooling that flags AI-generated code requiring deeper human review
• Apply the same scanning and review rigor to AI features in our own applications (RAG pipelines, agents, LLM-integrated workflows like our internal ESIconnect platform)
• Provide technical input to the policy and governance work owned by Security Leadership and GRC — but you build, they publish
• Run the application vulnerability backlog: triage, prioritization, exception workflow, SLAs
• Contribute to incident response for application-layer events
• Support audit and SOX evidence collection by ensuring tooling output is retainable and queryable — the goal is automation, not screenshots

Skills

• A working knowledge of Information Technology at a level normally acquired through completion of a Bachelor's degree in Information Technology, Cybersecurity, Computer Science or related field
• Four years' experience in application security, DevSecOps, or a software engineering role with substantial security responsibility
• Strong working code in at least one of: Python, JavaScript/TypeScript, C#/.NET, or Go — you can write tooling, not just read it
• Working knowledge of OWASP Top 10, common vulnerability classes, and how they manifest in modern frameworks
• Personal, hands-on experience using AI coding tools (Copilot, Cursor, Claude Code, or equivalent) - you can speak credibly about what they do well and where they fail
• Working knowledge of cloud security fundamentals (Azure preferred — Entra ID, Key Vault, App Service, Storage, Defender for Cloud)
• Comfort with Git, branching strategies, and modern PR-driven workflows
• Production experience integrating security scanners into CI/CD (GitHub Actions or Azure DevOps preferred); you've configured them, tuned them, and replaced them
• Hands-on experience writing custom rules in Semgrep, CodeQL, or a comparable engine

Benefits

• Annual short-term incentive bonus of up to 30% of eligible wages based on eligibility and company goal achievement.
• Medical insurance (health savings account), including free programs Hinge Health and Omada
• Enhanced mental health and work-life services through Lyra Health
• Virtual care through Doctor on Demand
• Prescription delivery service
• Dental insurance
• Vision insurance
• Life insurance for employees, spouses, and dependents
• Accidental death and dismemberment (AD&D) insurance
• Flexible spending accounts
• 401(k) plan with matching contribution and retirement contribution
• Hospital Insurance
• Accident Insurance
• Critical Illness Insurance
• Disability insurance
• Sick leave
• Vacation
• 11 paid holidays
• Flexible work hours, where feasible
• Employee discount programs

Company Overview