100% REMOTE - Application Security Engineer

STEPS Talent; Boston (MA); Teletrabalho; USD 150 000 - 190 000; Tempo integral

Resumo da oferta

STEPS Talent seeks a Senior Security Engineer - Application Security to join our Information Security team remotely. You will protect our infrastructure, applications, cloud security, and customer trust as part of a lean, cross-functional team spanning AppSec, CloudSec, SecOps, ITSec, and Compliance.

You will lead secure SDLC practices, partner with engineering to embed security in architecture and deployment, and perform hands-on testing of web apps, APIs, and cloud services while building

Qualificações

• 4+ years in application/product/software security as an individual contributor or software engineer turned security
• Strong understanding of vulnerabilities and attack techniques including OWASP Top 10 and API risks
• Experience manual security testing of web apps, APIs and distributed systems
• Ability to review architecture and source code for security weaknesses
• Experience integrating security tools into CI/CD workflows
• Familiarity with SAST, DAST, secrets detection, container security, IaC scanning
• Knowledge of authentication, authorization, session management, cryptography, secrets management
• Strong cloud expertise (AWS/GCP/Azure) and AI code development security implications
• Experience establishing enterprise-wide security policies and guidelines

Responsabilidades

• Lead the development and implementation of robust application security protocols across the SDLC
• Partner with engineering to embed security into architecture, design, development, testing and deployment
• Perform hands-on security testing of web apps, APIs and cloud-native services
• Build and improve automated security testing within CI/CD pipelines (SAST, SCA, DAST, secrets, container scanning, dynamic testing)
• Evaluate effectiveness of security tools and reduce findings and developer friction
• Develop secure coding standards and developer-focused documentation
• Contribute security expertise to vulnerability management and incident response
• Assess third-party apps, libraries, APIs for security risk
• Ensure compliance with healthcare regulatory requirements (e.g., HIPAA, GDPR) across product lines

Conhecimentos

Application Security

OWASP Top 10

API security

Web security testing

CI/CD security

Cloud security

Security policies

Architecture review

Descrição da oferta de emprego

Position: Senior Security Engineer - Application Security

Location: 100% REMOTE

Duration: DIRECT HIRE – FULL TIME

Skills/Experience Needed:

• 4+ years of professional experience in application, product or software security, operating as an individual contributor, OR as a software engineer that has pivoted into security
• Strong understanding of application security vulnerabilities and attach techniques, including OWASP Top 10 and API security risks
• Experience performing manual security testing of modern web applications, APIs and distributed systems
• Ability to review application architecture and source code for security weaknesses
• Experience integrating application security tools into modern CI/CD workflows
• Familiarity with static application security testing, dynamic testing, secrets detection, container security and infrastructure-as-code scanning
• Understanding of authentication, authorization, session management, cryptography, secrets management and secure API design
• Strong expertise in cloud technology (AWS, Google Cloud Platform, or Azure), modern programming languages, utilization of generative coding utilities, and the security implications of utilizing AI code development utilities.
• Demonstrated experience researching, establishing, and successfully rolling out enterprise-wide security policies and guidelines.

Summary:

This is an opportunity to join our Information Security team as a Senior Security Engineer - Application Securityand operate with foresight in protecting our infrastructure, applications, cloud security, and customer trust. As a lean team, we span across multiple areas such as AppSec, CloudSec, SecOps, ITSec, and Compliance and apply it towards reading and interpreting architecture, or planning and building out net new security solutions.

Responsibilities:

• Lead the development and implementation of robust application security protocols throughout the entire Software Development Lifecycle (SDLC).
• Partner with engineering teams to incorporate security into architecture, design, development, testing and deployment
• Perform hands-on security testing of web applications, APIs, cloud-native services and supporting infrastructure
• Build and improve automated security testing within CI/CD pipelines, including static analysis, dependency scanning, secrets detection, container scanning and dynamic testing
• Evaluate effectiveness of application security tools, improve tooling output quality and reduce unnecessary findings and developer friction
• Develop secure coding standards with developer-focused documentation
• Contribute application security expertise to vulnerability management, during security incidents/investigations and post-incident reviews
• Evaluate third party applications, libraries and APIs and integrations for security risk
• Ensure adherence to relevant healthcare regulatory and compliance requirements (e.g., HIPAA, GDPR, etc.) across all product lines and systems.