Senior Application Security Engineer
Summary
Builds and matures an application security program for a Texas healthcare organization: secure code reviews, web/API pentesting, and embedding SAST/DAST/SCA into CI/CD, plus Azure security reviews and threat modeling. Key tools: Burp Suite, OWASP ZAP, Metasploit. Hybrid, ~50% onsite in Austin.
Superlanet is seeking a Senior Application Security Engineer for our healthcare client in Texas. This is a hybrid position requiring approximately 50% onsite presence and is a direct-hire opportunity.
The Senior Application Security Engineer will play a key role in building and maturing the organization’s Application Security program, embedding security throughout the software development lifecycle across cloud, enterprise, research, and clinical applications.
The engineer will be responsible for secure code reviews, application vulnerability assessments, penetration testing, and security testing while partnering directly with development teams to identify and remediate vulnerabilities. The role will also establish secure development standards and strengthen application security processes as the organization expands its technology environment and prepares for future hospital operations.
Key Responsibilities
- Develop, implement, and mature Secure Software Development Lifecycle (SSDLC) standards and application security practices.
- Perform manual and automated secure code reviews, identifying vulnerabilities including OWASP Top 10 and CWE Top 25 risks.
- Conduct web application and API security assessments, vulnerability scanning, and penetration testing.
- Utilize Burp Suite, OWASP ZAP, and Metasploit for application testing, vulnerability validation, and controlled exploitation.
- Integrate SAST, DAST, and Software Composition Analysis (SCA) capabilities into CI/CD pipelines.
- Partner directly with developers to remediate vulnerabilities and provide secure coding guidance.
- Assess application security within Microsoft Azure, including identity and access management, network segmentation, and resource-level controls. Senior Application Security Eng…
- Evaluate API security, including authentication, authorization, and data-validation controls.
- Conduct threat modeling and security architecture reviews for new applications and integrations.
- Support security assessments involving AI/ML applications, generative AI, automation, biomedical systems, and connected medical technologies.
- Maintain application security documentation, standards, procedures, and risk-based vulnerability tracking.
- Communicate technical vulnerabilities and business risk effectively to both technical teams and leadership. Senior Application Security Eng…
Required Qualifications
- Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent professional experience.
- Approximately 5+ years of directly relevant, hands-on application security experience, with a strong focus on application security, secure code review, or penetration testing rather than general cybersecurity alone.
- Hands-on experience with Burp Suite, OWASP ZAP, and Metasploit.
- Strong understanding of OWASP Top 10, CWE Top 25, secure coding principles, and common web application vulnerabilities.
- Experience performing manual and automated secure code reviews.
- Experience with web application and API penetration testing, vulnerability validation, and remediation.
- Experience establishing or improving SSDLC practices.
- Working knowledge of SAST, DAST, and SCA technologies such as Checkmarx, Veracode, SonarQube, or similar platforms.
- Experience integrating security testing into CI/CD pipelines.
- Cloud application security experience, particularly within Microsoft Azure. Senior Application Security Eng…
- Strong technical troubleshooting, documentation, risk assessment, and cross-functional communication skills.
Preferred Qualifications
- Experience within healthcare, an academic medical center, higher education, or another highly regulated environment.
- Familiarity with HIPAA, HITRUST, NIST CSF 2.0, and related security frameworks.
- Experience with Azure DevOps, GitHub, Adobe Experience Cloud, or comparable enterprise development platforms.
- Experience with threat modeling, security architecture reviews, and secure software supply-chain practices.
- Familiarity with AI/ML security, generative AI security, biomedical systems, connected medical devices, robotics, or automation security. Senior Application Security Eng…
- Experience with QA/test automation and incorporating security assessments into automated testing processes.
Preferred certifications include: OSCP, GWAPT, CSSLP, CEH, and Microsoft Azure Security Engineer Associate (AZ-500).