Application Security Engineer

Purpose Brands; Boca Raton (FL); Híbrido; USD 110 000 - 140 000; Tempo integral

Vantagens oferecidas por esta oferta de emprego

Hybrid Work Environment

401K Matching

Medical Coverage

Dental & Vision

Life Insurance

Therapy Sessions

Mental Health Benefits

Employee Discounts

Resumo da oferta

Purpose Brands, the parent company of Orangetheory, Anytime Fitness, Waxing the City, and The Bar Method, is seeking an Application Security Engineer to join its team in Boca Raton. This role focuses on embedding security controls, automation, and secure development practices directly into the software delivery lifecycle for cloud-based applications.

The Application Security Engineer will partner with software engineering, DevOps, and cloud teams to mature security processes, improve

Qualificações

• 3–5 years of experience in application security, security engineering, or software engineering with a strong security focus.
• Hands-on code reviews and security testing across modern languages, frameworks, and APIs.
• Experience with SAST, DAST, and dependency scanning tools.

Responsabilidades

• Embed application security into the SDLC and promote secure coding practices.
• Perform SAST/DAST/SCA assessments and manage vulnerability remediation.
• Integrate security tooling into CI/CD pipelines and automate security processes.
• Collaborate with engineering, DevOps, and cloud teams for secure cloud workloads.

Conhecimentos

Code reviews

Application security testing

SAST/DAST/Dependency scanning

OWASP Top 10

CI/CD & DevSecOps concepts

Security tooling integration

Formação académica

Bachelor's degree in CS/IS/Engineering

Ferramentas

GitHub Advanced Security

Syft

Clair

Qualys

Dependabot

Descrição da oferta de emprego

Purpose Brands, the parent company of Orangetheory, Anytime Fitness, Waxing the City, and The Bar Method, is seeking a Application Security Engineer to join its team. This is a great position for someone who is looking to expand their career, and join a company with a fun, fast-paced and inspirational culture.The Application Security Engineer will report to the Staff Security Engineer and will be responsible for advancing application security capabilities as part of a DevSecOps operating model. This role focuses on embedding security controls, automation, and secure development practices directly into the software delivery lifecycle for cloud-based applications.The Application Security Engineer will report to the Staff Security Engineer and will be responsible for advancing application security capabilities as part of a DevSecOps operating model. This role focuses on embedding security controls, automation, and secure development practices directly into the software delivery lifecycle for cloud-based applications.The Application Security Engineer will partner closely with software engineering, DevOps, and cloud teams to mature security processes, improve vulnerability detection and remediation workflows, and reduce risk without slowing delivery. This position emphasizes hands-on application security engineering, security tooling integration, and developer enablement across applications deployed in AWS and Azure environments.Purpose/Impact: (Duties & Essential Functions)Application Security & Secure SDLCEmbed application security practices into all phases of the software development lifecycle (SDLC), from design through deployment and maintenancePerform application security assessments including static code analysis (SAST), dynamic testing (DAST), and software composition analysis (SCA)Develop and maintain threat models for critical systems and applications, collaborating with engineering teams to identify threats, assess risk, and drive remediation effortsPromote secure coding practices and contribute to secure development standards aligned with OWASP and industry best practicesDevSecOps Enablement & AutomationPartner with engineering and DevOps teams to integrate security tooling into CI/CD pipelines, enabling automated and repeatable security testingAnalyze and manage vulnerability findings from tools such as GitHub Advanced Security, Syft, Clair, Qualys, etc.Help tune security tooling to reduce false positives and improve signal quality for development teamsSupport the adoption of security automation to improve consistency, efficiency, and scalability across application environmentsCloud & Platform Security CollaborationAssist in securing applications deployed across AWS and Azure, including workloads running on IaaS, PaaS, and container-based platformsIdentify risks to the confidentiality, integrity, and availability of application data hosted in cloud-based environmentsCollaborate with cloud and platform security engineers to ensure application security controls align with broader cloud security architectureOwn and curate security controls within the Cloud Engineering and Platform Engineering space that align with security frameworks and controls like NIST CSF, CIS Benchmarks, and CSA CCMRisk Management, Monitoring & ResponseTriage, prioritize, and track remediation of application vulnerabilities based on risk and business impactAssist in security investigations involving application vulnerabilities or security eventsParticipate in periodic reviews of application security controls to validate effectiveness and compliance with organizational standardsCollaboration & Continuous ImprovementAct as a security partner to engineering teams by providing guidance, education, and actionable recommendationsContribute to the continuous improvement of application security processes, standards, and metricsSupport governance, risk management, and compliance initiatives as they relate to application securityQUALIFICATIONSBachelor’s degree in Computer Science, Information Systems, Engineering, or a related field3–5 years of experience in application security, security engineering, or software engineering with a strong security focusHands-on experience performing code reviews and application security testing across modern languages, frameworks, and APIsExperience working with application security tools such as SAST, DAST, and dependency scanning (e.g., GitHub Dependabot or similar)Strong understanding of OWASP Top 10, secure coding principles, authentication/authorization, and API securityPractical experience supporting applications running in AWS and/or Azure cloud environmentsFamiliarity with CI/CD pipelines, DevOps workflows, and DevSecOps conceptsAbility to communicate security risks and remediation guidance clearly to developers and non-security stakeholdersStrong analytical skills with the ability to balance security risk with delivery velocityPreferred certifications include:Security+, CSSLP, GWAPT, GWEB, CEH, GPEN or other application security–focused certificationsWhat’s in it for you?We offer a competitive salary along with exceptional benefits such as:Medical, Dental and Vision CoverageHybrid Work EnvironmentLife and Disability InsuranceUnlimited Time off + Paid HolidaysFlexible Friday's between Memorial Day and Labor Day401(K) Savings Plan Matching at 4%10 Coaching and Therapy sessionsMental Health BenefitsBrand Discounts & ReimbursementsIn-house workout facilitiesProfessional Development OpportunitiesTeam Building, Employee Engagement Activities & so much moreWORK SCHEDULEPurpose Brands LLC, currently observe the following hybrid work model for employees at our Boca Raton (FL), Woodbury (MN), and Seattle (WA) offices:Remote optional: FridaysOn-site days: Mondays, Tuesdays, Wednesdays and ThursdaysDIVERSITY, EQUITY, AND INCLUSION STATEMENTPurpose Brands is committed to encouraging, facilitating, and upholding an environment centered on diversity, equity, and inclusion across every facet of the Purpose Brands. We will work to create a sustainable culture that supports a healthy space for learning and growing, valuing, and empowering every employee, inspiring a diverse franchise network, and uplifting the members and communities we serve.EEO STATEMENTPurpose Brands provides equal employment opportunity to all individuals regardless of their race, color, creed, religion, gender, age, sexual orientation, national origin, disability, veteran status, or any other characteristic protected by state, federal, or local law. Discrimination of any type will not be tolerated.