Remote Senior Application Security Engineer

Placements24; Kimberley; Hybrid; CAD 120,000 - 170,000; Full time

Benefits offered by this job

Stock options

Remote work

Learning budget

Job summary

Placements24 is seeking a Senior Application Security Engineer to join a fully remote engineering team and embed security best practices across the SDLC. You will identify and mitigate vulnerabilities in web and mobile apps, collaborating with development teams and promoting secure coding practices.

The role focuses on SAST, DAST, and IAST, with experience in Veracode, Checkmarx, SonarQube, and OWASP ZAP. A Bachelor's degree and 6+ years in the field are preferred, with strong remote work

Qualifications

• 6+ years of experience in application security engineering or a closely related field.
• Experience with SAST, DAST, IAST, and SCA tools (e.g., Veracode, Checkmarx, SonarQube, OWASP ZAP).
• Strong understanding of OWASP Top10 and mobile security threats.
• Experience with secure SDLC methodologies and integrating security into DevOps processes.
• Proficiency in Java, Python, C#, or JavaScript.
• Experience with API security, container security (Docker, Kubernetes), and cloud security is desirable.
• Certifications such as CISSP, CSSLP, GWAPT, or GIAC are a plus.
• Ability to work effectively in a fully remote, asynchronous environment.

Responsibilities

• Design, implement, and manage application security programs and initiatives.
• Conduct SAST, DAST, and IAST testing and remediation.
• Collaborate with development teams to identify, prioritize, and remediate vulnerabilities.
• Develop and enforce secure coding standards and guidelines.
• Integrate security tools into CI/CD pipelines (DevSecOps).
• Perform threat modeling for new features and applications.
• Provide security training and guidance to developers on secure coding.

Skills

Application security

Secure SDLC

DevSecOps

Vulnerability remediation

Programming knowledge

Education

Bachelor's degree

Master's degree preferred

Tools

Veracode

Checkmarx

SonarQube

OWASP ZAP

Job description

About the Role

Our client, an innovative software development company with a global reach, is seeking a highly skilled Senior Application Security Engineer to join their fully remote engineering team. This role is central to embedding security best practices throughout the software development lifecycle (SDLC). You will be responsible for identifying and mitigating security vulnerabilities in web and mobile applications, collaborating with development teams, and advocating for secure coding practices. The ideal candidate possesses a deep understanding of application security principles, secure SDLC methodologies, and extensive experience with SAST, DAST, and IAST tools. This position is 100% remote, offering unparalleled flexibility and the chance to work on cutting-edge projects from anywhere.

Key Responsibilities

• Design, implement, and manage application security programs and initiatives.
• Conduct security code reviews, static application security testing (SAST), dynamic application security testing (DAST), and interactive application security testing (IAST).
• Collaborate closely with development teams to identify, prioritize, and remediate application security vulnerabilities.
• Develop and enforce secure coding standards and guidelines.
• Integrate security tools and processes into the CI/CD pipeline (DevSecOps).
• Perform threat modeling for new features and applications.
• Provide security training and guidance to developers on secure coding practices.
• Investigate and respond to security incidents related to applications.
• Stay current with emerging application security threats, vulnerabilities, and industry best practices.
• Contribute to the architecture and design of secure applications.

Requirements

• Bachelor's degree in Computer Science, Cybersecurity, or a related field; Master's degree preferred.
• Minimum of 6 years of experience in application security engineering or a closely related field.
• Proven experience with SAST, DAST, IAST, and SCA tools (e.g., Veracode, Checkmarx, SonarQube, OWASP ZAP).
• Strong understanding of common web vulnerabilities (OWASP Top10) and mobile security threats.
• Experience with secure SDLC methodologies and integrating security into DevOps processes.
• Proficiency in one or more programming languages (e.g., Java, Python, C#, JavaScript).
• Experience with API security, container security (Docker, Kubernetes), and cloud security is highly desirable.
• Excellent communication, collaboration, and problem-solving skills.
• Relevant certifications such as CISSP, CSSLP, GWAPT, or GIAC certifications are a strong asset.
• Demonstrated ability to work effectively in a fully remote, asynchronous environment.

Benefits

• Highly competitive salary and performance bonuses.
• Full remote work arrangement with excellent work-life balance.
• Comprehensive health, dental, and vision insurance.
• Generous stock options package.
• Significant budget for continuous learning, certifications, and conference attendance.
• Opportunity to influence the security posture of innovative software products.
• Home office equipment allowance.