Application Security Engineer

Jobot Consulting; New York (NY); Hybrid; USD 125,000 - 146,000; Full time

Job summary

Jobot Consulting seeks an experienced Application Security Engineer to build and scale an enterprise AppSec program. You will own discovery, tooling, CI/CD integration, and collaboration with engineering leaders across business units.

This hybrid role requires three days on site and offers exposure to SAST, SCA, AI-assisted security workflows, and meaningful metrics for leadership. You’ll influence security practices while delivering secure software at velocity.

Qualifications

• 7+ years of experience in application security, product security, or security engineering.
• 3+ years of experience supporting complex environments with multiple independent business units, brands, product groups, or engineering organizations.
• Hands-on experience implementing and operating modern AppSec tools such as Semgrep, Snyk, Checkmarx, Veracode, Apiiro, Ox Security, GitHub Advanced Security, or similar platforms.
• Code-level proficiency in at least three commonly used programming languages such as Python, JavaScript/TypeScript, Java, C#, or Go, with the ability to review code and effectively validate security findings.
• Strong scripting and automation skills, ideally in Python or a comparable language.
• Experience building integrations using REST APIs and working within CI/CD environments such as GitHub Actions, GitLab CI, Jenkins, or Azure DevOps.
• Demonstrated success influencing engineering teams and driving security adoption without direct authority.
• Strong understanding of the OWASP Top 10, modern application attack patterns, software supply chain risks, and threat modeling methodologies such as STRIDE or PASTA.

Responsibilities

• Lead application discovery and inventory efforts across multiple business units, including application ownership mapping, technology stack profiling, and risk tiering.
• Implement, integrate, and operate modern application security tooling, including SAST, SCA, secrets scanning, container security, and Infrastructure-as-Code scanning.
• Embed security tooling and controls directly into CI/CD pipelines to make security part of the development lifecycle rather than a separate process.
• Design and implement AI-assisted triage workflows to help prioritize findings, reduce false positives, and prevent development teams from becoming overwhelmed by security alerts.
• Establish and evolve secure SDLC standards, threat modeling practices, security requirements, and development gates.
• Partner closely with engineering and development leaders to create practical AppSec playbooks that improve security while supporting speed of delivery.
• Help shape the organization’s approach to AI within application security, including evaluating emerging capabilities such as AI-assisted code review, agentic security testing, automated security requirements, and remediation guidance.
• Develop meaningful metrics and executive-level reporting that connect application security initiatives to measurable reductions in business and technology risk.

Skills

Python

JavaScript/TypeScript

Java

C#

Go

Automation scripting

CI/CD integrations

OWASP Top 10

Threat modeling

Tools

Semgrep

Snyk

Checkmarx

Veracode

Apiiro

Ox Security

GitHub Advanced Security

Job description

Job details

This Jobot Consulting Job is hosted by: Amanda Preston

Salary: $60 - $70 per hour

A bit about us

We are a large, diversified organization with a broad portfolio of businesses, brands, and digital products operating across multiple industries. Our technology and cybersecurity teams support a complex enterprise environment while giving individual business units the flexibility to operate and innovate within their own markets. As our application security program continues to evolve, we are investing in modern security tooling, automation, and AI-assisted capabilities that help development teams build and deploy securely without slowing delivery.

Why join us

• Build, don’t just maintain. You’ll have an opportunity to help shape and mature an enterprise AppSec program rather than simply inherit a fully established environment.
• Work across a highly diverse technology ecosystem. The organization supports multiple businesses and development teams, creating exposure to a wide variety of applications, technology stacks, and security challenges.
• Bring AI into real-world security workflows. This team is actively exploring how AI can improve application security operations, from smarter triage to automated testing and remediation.
• High visibility and meaningful impact. Your work will influence how development teams across the organization approach secure software development and will be visible to senior technology and security leadership.
• Technical depth with strategic influence. This role combines hands-on engineering with the opportunity to establish standards, influence development leaders, and help determine the future direction of the AppSec program.

Job Details

We are seeking an experienced Application Security Engineer to play a key role in building and scaling our application security program.

This position will have visibility across the full AppSec lifecycle, from discovering and inventorying applications across the enterprise to implementing security tooling, integrating controls into CI/CD pipelines, and helping development teams adopt secure engineering practices.

This is not a purely heads-down technical role. The right person will be equally comfortable working with security tools and code as they are partnering with engineering leaders across independent business units. Success will require technical depth, strong communication skills, and the ability to influence teams without direct authority.

This is a hybrid position requiring three days per week onsite at one of our designated offices.

What You’ll Do

• Lead application discovery and inventory efforts across multiple business units, including application ownership mapping, technology stack profiling, and risk tiering.
• Implement, integrate, and operate modern application security tooling, including SAST, SCA, secrets scanning, container security, and Infrastructure-as-Code scanning.
• Embed security tooling and controls directly into CI/CD pipelines to make security part of the development lifecycle rather than a separate process.
• Design and implement AI-assisted triage workflows to help prioritize findings, reduce false positives, and prevent development teams from becoming overwhelmed by security alerts.
• Establish and evolve secure SDLC standards, threat modeling practices, security requirements, and development gates.
• Partner closely with engineering and development leaders to create practical AppSec playbooks that improve security while supporting speed of delivery.
• Help shape the organization’s approach to AI within application security, including evaluating emerging capabilities such as AI-assisted code review, agentic security testing, automated security requirements, and remediation guidance.
• Develop meaningful metrics and executive-level reporting that connect application security initiatives to measurable reductions in business and technology risk.

Required Qualifications

• 7+ years of experience in application security, product security, or security engineering.
• 3+ years of experience supporting complex environments with multiple independent business units, brands, product groups, or engineering organizations.
• Hands-on experience implementing and operating modern AppSec tools such as Semgrep, Snyk, Checkmarx, Veracode, Apiiro, Ox Security, GitHub Advanced Security, or similar platforms.
• Code-level proficiency in at least three commonly used programming languages such as Python, JavaScript/TypeScript, Java, C#, or Go, with the ability to review code and effectively validate security findings.
• Strong scripting and automation skills, ideally in Python or a comparable language.
• Experience building integrations using REST APIs and working within CI/CD environments such as GitHub Actions, GitLab CI, Jenkins, or Azure DevOps.
• Demonstrated success influencing engineering teams and driving security adoption without direct authority.
• Strong understanding of the OWASP Top 10, modern application attack patterns, software supply chain risks, and threat modeling methodologies such as STRIDE or PASTA.

Preferred Qualifications

• Experience incorporating LLM or AI-based capabilities into security workflows, including alert triage, finding summarization, remediation guidance, or security automation.
• Familiarity with security and compliance frameworks such as HITRUST, HIPAA, NIST AI RMF, or SOC 2.
• Experience working within a regulated, healthcare, or healthcare-adjacent environment.
• Strong cloud security knowledge across AWS, Azure, or GCP.
• Contributions to the broader application security community through open-source projects, conference presentations, research, detection rules, or similar work.

Jobot is an Equal Opportunity Employer. We provide an inclusive work environment that celebrates diversity and all qualified candidates receive consideration for employment without regard to race, color, sex, sexual orientation, gender identity, religion, national origin, age (40 and over), disability, military status, genetic information or any other basis protected by applicable federal, state, or local laws. Jobot also prohibits harassment of applicants or employees based on any of these protected categories. It is Jobot's policy to comply with all applicable federal, state and local laws respecting consideration of unemployment status in making hiring decisions.

Sometimes Jobot is required to perform background checks with your authorization. Jobot will consider qualified candidates with criminal histories in a manner consistent with any applicable federal, state, or local law regarding criminal backgrounds, including but not limited to the Los Angeles Fair Chance Initiative for Hiring and the San Francisco Fair Chance Ordinance.

Information collected and processed as part of your Jobot candidate profile, and any job applications, resumes, or other information you choose to submit is subject to Jobot's Privacy Policy, as well as the Jobot California Worker Privacy Notice and Jobot Notice Regarding Automated Employment Decision Tools which are available at jobot.com/legal.

By applying for this job, you agree to receive calls, AI-generated calls, text messages, or emails from Jobot, and/or its agents and contracted partners. Frequency varies for text messages. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You can reply STOP to cancel and HELP for help. You can access our privacy policy here: jobot.com/privacy-policy