[Remote] Vulnerability Engineer - Application Security
Note: The job is a remote job and is open to candidates in USA. Insight Global is seeking a Vulnerability Engineer to support enterprise application security by identifying, prioritizing, and coordinating remediation of application vulnerabilities. The role focuses on secure software development practices, CI/CD security integration, reporting, automation, governance, and collaboration with development, DevOps, cloud, architecture, and platform teams.
Responsibilities
- Analyze and validate application security findings from SAST, DAST, SCA, container, secrets scanning, and related AppSec tools
- Support risk-based prioritization of code-level vulnerabilities using exploitability, business criticality, application exposure, and remediation complexity
- Validate findings, reduce false positives, and provide clear technical guidance to development teams
- Perform trend analysis to identify recurring insecure coding patterns, vulnerable dependencies, and systemic SDLC improvement opportunities
- Support application security exceptions, compensating controls, and risk acceptance processes
- Coordinate remediation of application security findings across development, DevOps, product, cloud, and platform teams
- Track remediation progress against established SLAs, release timelines, and escalation criteria
- Provide secure coding guidance and technical recommendations to developers and application owners
- Verify remediation completion through retesting, code review, pipeline results, and validation activities
- Support creation of actionable remediation work items through ServiceNow, Azure DevOps Boards, GitHub Issues, Jira, or equivalent developer workflow tools
- Support secure software development lifecycle processes, including security requirements, threat modeling inputs, code review practices, and release security gates
- Partner with Application Security, DevOps and engineering teams to integrate security testing and policy controls into CI/CD pipelines
- Develop and maintain secure development standards, procedures, knowledge articles, and developer enablement materials
- Ensure application security practices align with audit, compliance, regulatory, and internal governance requirements
- Assist with application security exceptions, risk register entries, and governance reporting
- Develop and maintain application security reports and dashboards
- Track metrics such as application vulnerability aging, remediation performance, SLA adherence, scan coverage, policy violations, and pipeline gate outcomes
- Support executive, product, engineering, and operational reporting requirements
- Validate reporting accuracy, application ownership, repository mapping, and data quality
- Contribute to optimization of application security platforms and developer-facing security tooling
- Support automation initiatives for vulnerability ingestion, prioritization, ticketing, remediation tracking, and CI/CD pipeline integration
- Improve integration and data quality across application inventories, code repositories, CI/CD platforms, CMDB, and exposure management systems
- Evaluate opportunities to streamline developer remediation workflows and reduce friction in secure software delivery
- Serve as a subject matter expert for application security, secure development, and code-level vulnerability remediation activities
- Collaborate with Security Architecture, Application Security, Security Engineering, GRC, Application Development, DevOps, Cloud, Product, Data, and Platform teams
- Communicate technical risks, remediation options, and secure coding recommendations to developers, application owners, and business stakeholders
Skills
- 3+ years in cybersecurity, application security, software development, DevSecOps, cloud security, or security operations
- Experience working with application security tools and processes, including secure code analysis, dependency scanning, dynamic testing, or related application security capabilities
- Experience with ASM/CAASM, SOAR, and Exposure Management platforms
- Working knowledge of CI/CD pipelines, source code repositories, branching strategies, build and release workflows, and modern code development processes
- Strong understanding of application vulnerability identification, prioritization, remediation, validation, and secure coding practices
- Strong analytical, troubleshooting, and communication skills
- Experience working collaboratively across development, DevOps, security, and technical teams
- Experience with SAST, DAST, SCA, secrets scanning, container security, API security, and developer security platforms
- Familiarity with common development languages, frameworks, package managers, CI/CD platforms, and repository management tools such as GitHub, GitLab, Azure DevOps, Jenkins, or equivalent platforms
- Familiarity with OWASP Top 10, NIST, CIS, secure SDLC practices, and regulatory requirements
- Experience supporting enterprise application security, DevSecOps, or vulnerability remediation programs
Company Overview
Company H1B Sponsorship