Application Security Engineer

Akaasa Technologies; North Carolina; Hybrid; USD 140,000 - 190,000; Full time

Job summary

Akaasa Technologies is seeking an Application Security Engineer to drive security across a hybrid environment in New York, NY or Charlotte, NC. You will lead discovery of applications, deploy and manage SAST/SCA and AI-assisted workflows, and collaborate with developers to embed security into the SDLC.

The role requires 7+ years in the field, hands-on tool experience, and strong scripting skills to automate integrations with CI/CD pipelines.

Qualifications

• 7+ years in application security across multiple business units.
• Hands-on with modern security tools such as Semgrep, Snyk, Checkmarx, Veracode, Apiiro, Ox Security, or GitHub Advanced Security.
• Proficiency in Python, JavaScript/TypeScript, Java, C#, or Go for reading, reviewing, and triaging findings.

Responsibilities

• Leads the discovery and inventory of applications across units, including ownership mapping and risk tiering.
• Stands up and operates the application security tooling stack (SAST, SCA, secrets scanning, container/IaC scanning) in CI/CD pipelines.
• Designs and implements AI-assisted triage workflows to reduce developer workload and filter false positives.
• Defines secure SDLC requirements, threat modeling practices, and security gates adopted by business units.
• Partners with development leaders to build relationships and operationalize security without delaying delivery.
• Contributes to AI security strategy by evaluating tools like AI code review assistants and automated testing solutions.
• Produces executive-ready metrics showing how security activities mitigate business risks.

Skills

Application Security

SAST

SCA

Secrets Scanning

Container/IaC Scanning

CI/CD Pipelines

Python Scripting

REST API Integrations

Influence Stakeholders

AI-assisted Workflows

Tools

Semgrep

Snyk

Checkmarx

Veracode

Apiiro

Ox Security

GitHub Advanced Security

Job description

About the job

Application Security Engineer | Location: Hybrid, New York, NY or Charlotte, NC | Contract

This role is a key contributor to an enterprise-wide application security program, focusing on discovering, inventorying, and securing business applications across multiple units. The position involves implementing advanced security tooling, integrating AI-assisted workflows, and collaborating closely with development teams to embed security into the SDLC.

Key Responsibilities

• LEADS the discovery and inventory of applications across all business units, including ownership mapping, technology stack profiling, and risk tiering.
• STANDS UP and OPERATES the application security tooling stack, including SAST, SCA, secrets scanning, and container/IaC scanning, integrated into CI/CD pipelines.
• DESIGNS and IMPLEMENTS AI-assisted triage workflows to manage security findings, reducing developer overload and filtering false positives.
• DEFINES secure SDLC requirements, threat modeling practices, and security gates adopted by business units.
• PARTNERS with development leaders to build relationships and operationalize application security practices without impeding delivery timelines.
• CONTRIBUTES to AI security strategy by evaluating emerging tools such as AI code review assistants and automated security testing solutions, recommending operationalization strategies.
• PRODUCES executive-ready metrics and reports that demonstrate how application security activities mitigate business risks.

Required Qualifications

• 7+ years in application security, product security, or security engineering, with experience working across multiple independent business units or product lines.
• Hands-on experience deploying and managing modern application security tools such as Semgrep, Snyk, Checkmarx, Veracode, Apiiro, Ox Security, or GitHub Advanced Security.
• Proficiency in at least three programming languages (e.g., Python, JavaScript/TypeScript, Java, C#, Go) for reading, reviewing, and triaging security findings.
• Strong scripting and automation skills in Python or similar, with experience building integrations against REST APIs and working within CI/CD environments like GitHub Actions, GitLab CI, Jenkins, or Azure DevOps.
• Proven ability to influence engineering teams and drive security adoption without direct authority, including negotiating standards and building shared security playbooks.

Preferred Qualifications

• Experience integrating LLM-based tooling into security workflows for alert triage, finding summarization, or remediation guidance.
• Familiarity with compliance frameworks such as HITRUST, HIPAA, NIST AI RMF, or SOC 2.
• Prior experience working in regulated or healthcare-adjacent environments.
• Cloud security expertise in at least one major provider (AWS, Azure, GCP).
• Contributions to the application security community through open-source projects, conference talks, or published research.