Application Security Engineer

Resolution Technologies, Inc.; Atlanta (GA); On-site; USD 130,000 - 170,000; Full time

Job summary

Resolution Technologies, Inc. is seeking an experienced Application Security Engineer to safeguard Salesforce, .NET, and Azure App Services environments.

You will drive secure coding, DevSecOps integration, and penetration testing across CI/CD pipelines with Git and Azure DevOps. You will review Salesforce security configuration, implement access controls, perform threat modeling, and align controls with NIST standards.

Qualifications

• 7+ years of experience in application security, DevSecOps, or related roles.
• Strong understanding of secure coding practices in .NET and Apex (Salesforce).
• Experience with Salesforce security architecture and Azure App Services.
• Proficiency in CI/CD pipelines and integrating security tools into Git and Azure DevOps workflows.
• Familiarity with NIST 800-53, NIST CSF, and other cybersecurity frameworks.
• Hands-on experience with SAST, DAST, SCA, and container security tools.

Responsibilities

• Review Apex code, Visualforce pages, and Lightning components for security vulnerabilities.
• Ensure proper configuration of Salesforce security settings including profiles, permission sets, role hierarchies, and sharing rules.
• Implement and monitor field-level security, object-level access, and record-level access controls.
• Validate secure integration patterns for external APIs and third-party apps within Salesforce.
• Enforce OAuth scopes, connected app policies, and IP restrictions.
• Conduct regular security health checks and Salesforce Shield audits.
• Align Salesforce security architecture with NIST 800-53 and NIST CSF controls.
• Collaborate with development teams to integrate security into the SDLC.
• Conduct secure code reviews for applications built on Salesforce, .NET, and Azure platforms.
• Design and review application architectures to ensure alignment with NIST controls.
• Perform threat modeling and risk assessments for new and existing applications.
• Maintain and enhance security integrations with Git, Azure DevOps, and other version control systems.
• Perform manual and automated penetration testing of web applications and APIs.
• Identify and remediate vulnerabilities in Salesforce customizations, .NET codebases, and Azure-hosted services.
• Own the configuration, tuning, and maintenance of DevSecOps tools (e.g., SonarQube, Checkmarx, Veracode, Fortify).
• Monitor and report on security tool performance and coverage.
• Map application security controls to NIST standards and support audit readiness.
• Document security requirements and ensure traceability to NIST control families.
• Partner with engineering, QA, and operations teams to drive security awareness and training.
• Provide guidance on secure coding standards and remediation strategies.
• Support incident response efforts related to application vulnerabilities.
• Contribute to risk assessments and mitigation planning for new and existing applications.

Skills

Secure coding practices

DevSecOps

Penetration testing

Threat modeling

Security architecture

Education

Bachelor's degree in Computer Science or related field

Tools

Git

Azure DevOps

SonarQube

Checkmarx

Veracode

Fortify

Job description

We are seeking a skilled and proactive Application Security Engineer to join our security team. This role is critical in ensuring the security of our applications across platforms including Salesforce, .NET applications, and Azure App Services. The ideal candidate will have a strong background in secure coding practices, DevSecOps, and penetration testing, with hands‑on experience managing security tools and integrating them into CI/CD pipelines using Git and Azure DevOps. Familiarity with NIST cybersecurity controls and secure design principles is essential.

Application Security Engineer Role and Responsibilities

• Review Apex code, Visualforce pages, and Lightning components for security vulnerabilities.
• Ensure proper configuration of Salesforce security settings including profiles, permission sets, role hierarchies, and sharing rules.
• Implement and monitor field-level security, object-level access, and record-level access controls.
• Validate secure integration patterns for external APIs and third‑party apps within Salesforce.
• Enforce OAuth scopes, connected app policies, and IP restrictions.
• Conduct regular security health checks and Salesforce Shield audits.
• Align Salesforce security architecture with NIST 800‑53 and NIST CSF controls.

Secure Development Lifecycle (SDLC):

• Collaborate with development teams to integrate security best practices into the SDLC.
• Conduct secure code reviews for applications built on Salesforce, .NET, and Azure platforms.
• Design and review application architectures to ensure alignment with NIST controls.
• Perform threat modeling and risk assessments for new and existing applications.
• Maintain and enhance security integrations with Git, Azure DevOps, and other version control systems.

Application Security Testing:

• Perform manual and automated penetration testing of web applications and APIs.
• Identify and remediate vulnerabilities in Salesforce customizations, .NET codebases, and Azure‑hosted services.

Tool Management:

• Own the configuration, tuning, and maintenance of DevSecOps tools (e.g., SonarQube, Checkmarx, Veracode, Fortify).
• Monitor and report on security tool performance and coverage.
• Map application security controls to NIST standards and support audit readiness.
• Document security requirements and ensure traceability to NIST control families.
• Partner with engineering, QA, and operations teams to drive security awareness and training.
• Provide guidance on secure coding standards and remediation strategies.
• Support incident response efforts related to application vulnerabilities.
• Contribute to risk assessments and mitigation planning for new and existing applications.

Application Security Engineer Required Qualifications

• Bachelor degree in Computer Science, Information Security, or related field (or equivalent experience).
• 7+ years of experience in application security, DevSecOps, or related roles.
• Strong understanding of secure coding practices in .NET and Apex (Salesforce).
• Experience with Salesforce security architecture and Azure App Services.
• Proficiency in CI/CD pipelines and integrating security tools into Git and Azure DevOps workflows.
• Familiarity with NIST 800‑53, NIST CSF, and other cybersecurity frameworks.
• Hands‑on experience with SAST, DAST, SCA, and container security tools.

Preferred Qualifications

Certifications such as OSCP, GWAPT, CSSLP, or Salesforce Security Specialist.