Application Security Engineer
Posted Updated 7
views
Summary
The Application Security Engineer manages the full vulnerability lifecycle, from discovery to remediation. The role involves operating security tools (SAST, SCA), building automation with Python or Go, integrating controls into CI/CD, and using AI agents for threat analysis across cloud infrastructure and application code.
You will own vulnerability management from discovery through remediation verification. You will investigate and prioritize findings, build automation, operate application-security tools, validate vulnerabilities, perform targeted security reviews, integrate controls into CI/CD, develop risk metrics, and support incident response for exploited vulnerabilities.
Responsibilities
- Improve vulnerability management across applications, dependencies, containers, operating systems, cloud infrastructure, and external services
- Use AI agents and security models for vulnerability discovery, analysis, testing, prioritization, and remediation
- Analyze vulnerabilities based on exploitability, exposure, assets, mitigations, and business impact
- Triage findings and drive risk-based remediation with engineering teams
- Build automation for vulnerability workflows and reporting
- Identify systemic vulnerability patterns and address root causes
- Operate SAST, SCA, secrets detection, container scanning, infrastructure scanning, and attack-surface monitoring
- Validate findings through technical investigation and hands-on testing
- Perform targeted application-security reviews and testing
- Integrate security controls into CI/CD and developer workflows
- Develop vulnerability and remediation metrics
- Support incident response for actively exploited vulnerabilities
Requirements
- Application or product security fundamentals and vulnerability-management experience
- Knowledge of vulnerability classes and exploitation techniques across web applications, APIs, authentication, cloud services, containers, and software supply chains
- Ability to read code and collaborate with software engineers on remediation
- Experience with vulnerability scanning and application-security technologies
- Knowledge of CVSS, exploitability, asset criticality, internet exposure, compensating controls, and threat intelligence
- Ability to investigate security findings manually
- Ability to automate security workflows with Python, Go, or similar languages
- Experience integrating security tooling into CI/CD
- Experience with Linux, Git, containers, and cloud environments
- Security-risk communication skills