Application Security Engineer

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an Application Security Engineer based in the United States. This is an opportunity to take ownership of application security across a modern, cloud-native technology environment. You will lead vulnerability management from discovery and prioritization through remediation, reporting, and continuous improvement. The role combines hands-on security engineering with strategic influence across software development and infrastructure teams. You will strengthen operating system images, open-source dependencies, and the broader software supply chain against emerging threats. You will also embed security validation directly into CI/CD workflows through automation, testing, and modern security tooling. Working cross-functionally, you will establish secure-coding practices and help engineering teams adopt security as part of everyday development. This role is ideal for a pragmatic security professional who enjoys solving complex problems and balancing strong protection with usability and delivery speed.

Accountabilities

Own vulnerability management

Lead the end-to-end vulnerability management lifecycle across the technology stack, including vulnerability discovery, risk prioritization, remediation, reporting, measurement, and continuous improvement.

Secure the software supply chain

Harden base operating system images and strengthen the security of open-source software, dependencies, package managers, and other components of the software supply chain.

Embed security into development

Integrate SAST, DAST, dependency scanning, automated validation, and other security controls into CI/CD pipelines to identify and address vulnerabilities earlier in the development lifecycle.

Evaluate security technologies

Research, assess, adopt, and develop security tools and approaches, including solutions such as Google Assured OSS and comparable technologies.

Establish secure-development practices

Define practical secure-coding standards and provide engineering teams with guidance, training, mentorship, and resources to improve security adoption.

Lead cross-functional initiatives

Partner with engineering and other technical teams to drive security programs, resolve critical vulnerabilities, and establish sustainable security processes.

Strengthen proactive security

Identify emerging application, infrastructure, and supply-chain risks and introduce technologies and processes that improve the overall security posture.

Balance security with engineering needs

Develop pragmatic solutions that protect systems effectively while maintaining performance, usability, developer productivity, and delivery velocity.

Requirements Education and experience

Bachelor’s degree in Computer Science, Cybersecurity, or a related discipline, or equivalent professional experience, combined with 8+ years of experience in application security and vulnerability management.

Security expertise

Deep understanding of software vulnerabilities, including CVEs, the OWASP Top 10, application security principles, and software supply-chain risks.

Security tooling

Hands-on experience with SAST, DAST, dependency scanning, and vulnerability management platforms such as Snyk, GitHub Dependabot, Trivy, Clair, Burp Suite, OWASP ZAP, or comparable technologies.

Cloud-native security

Strong experience securing cloud environments such as AWS and GCP, including containers, Kubernetes, microservices, and related infrastructure.

Automation and CI/CD

Ability to integrate security controls and automated validation into modern software delivery pipelines.

Technical leadership

Demonstrated ability to lead cross-functional security initiatives and influence engineering teams toward stronger security practices.

Problem-solving mindset

Proactive and pragmatic approach to identifying risks, evaluating solutions, and resolving complex technical security challenges.

Communication and collaboration

Strong interpersonal skills with the ability to explain security concepts clearly, build trust with engineering partners, and drive adoption without creating unnecessary friction.

Adaptability

Comfortable working in a fast-moving environment, managing ambiguity, and balancing security requirements with performance, usability, and business priorities.

Benefits Competitive compensation

Standard base salary range of $185,000–$260,000 USD annually, with compensation determined by factors including location, role level, knowledge, skills, and experience.

Additional compensation

Certain roles may be eligible for variable compensation and equity.

Healthcare coverage

Medical, vision, and dental benefits.

Retirement savings

Opportunity to contribute to a 401(k) plan.

Paid time off

Generous time-off policy to support rest and personal wellbeing.

Remote work

Fully remote position for candidates based in the United States.

Home office support

Home office improvement stipend to help create an effective remote workspace.

Learning and development

Annual education stipend supporting continued professional growth.

Wellness support

Annual wellness stipend focused on employee wellbeing.

Workplace culture

Regular company events and a collaborative environment designed to connect distributed teams.

Employee perks

Healthy lunches provided daily where applicable.

How Jobgether works

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice

By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1