App Security Engineer | DevSecOps & Threat Modeling

Ascensus; Pennsylvania; On-site; USD 110,000 - 150,000; Full time

Job summary

Ascensus seeks an Application Security Engineer to drive the security program across our web and API platforms. You will partner with scrum teams to embed security into the SDLC, perform threat modeling and architecture reviews, and lead remediation of vulnerabilities through SAST/DAST/SCA tooling.

You will collaborate with security leadership to align with regulatory requirements and industry standards while advancing Ascensus's core security goals and practices.

Qualifications

• Minimum 4 years in Secure Software Development and/or DevSecOps.
• Ability to define software security and privacy requirements.
• Solid understanding of threat modeling, risk, and mitigation from internal and external threats.
• Experience with security architecture diagrams and security architecture standards.
• Experience running security testing tools in CI/CD pipelines (SAST/DAST/SCA).
• Experience with application testing tools (Burp Suite, Fiddler, ZAP, Wireshark, Metasploit).
• Experience with WAF, API Gateway, and API Security Tools.
• Strong knowledge of OWASP Top 10 and related risks.
• Familiarity with SDL, SAMM, or BSIMM frameworks.

Responsibilities

• Protect confidential data and prevent unauthorized access or disclosure.
• Provide security consultation to scrum teams and technology groups on secure SDLC practices.
• Participate in sprint planning to embed security requirements into development.
• Conduct architecture reviews, data-flow analysis, and threat modeling activities.
• Support SAST, DAST, and SCA tools; triage findings and guide remediation.
• Develop and monitor application security policies and coding standards.
• Assist with deployment and integration of security tooling in CI/CD pipelines.
• Mentor teams on vulnerability remediation and security best practices.
• Handle additional security projects as assigned.

Skills

DevSecOps

Threat modeling

CI/CD security

Secure SDLC

Vulnerability remediation

Security architecture

Compliance awareness

Tools

Burp Suite

Fiddler

OWASP ZAP

Wireshark

Metasploit

Job description

Ascensus seeks an Application Security Engineer to drive the security program across our web and API platforms. You will partner with scrum teams to embed security into the SDLC, perform threat modeling and architecture reviews, and lead remediation of vulnerabilities through SAST/DAST/SCA tooling.

You will collaborate with security leadership to align with regulatory requirements and industry standards while advancing Ascensus's core security goals and practices.