Application Security Engineer

BigRio; United States; On-site; USD 120,000 - 170,000; Full time

Job summary

BigRio is seeking an Application Security Engineer to mature its security program across web, API, and pipeline apps, embedding security by design throughout the SDLC and protecting sensitive patient data.

You will implement SonarQube and Burp tooling, partner with engineering to remediate findings, and drive a structured remediation program while aligning with HIPAA and regulatory requirements. This is a chance to shape risk reduction across the organization.

Qualifications

• Bachelor's degree or equivalent in computer science, cybersecurity, or related field.
• 3–5 years in application security, DevSecOps, or security-focused software engineering.
• Hands-on experience with SonarQube for static code analysis and code quality gating.
• Familiarity with SAST/DAST/SCA/IAST tooling and CI/CD integration.
• Strong communication skills for cross-functional collaboration and risk translation.
• Knowledge of HIPAA, NIST, and GDPR as they apply to healthcare data.

Responsibilities

• Implement and manage static and dynamic code analysis within CI/CD pipelines.
• Perform penetration tests and remediation of findings across web, API, and pipelines.
• Develop a structured remediation program to address security findings quickly.
• Evolve SDLC into a Secure SDLC by embedding Security by Design and Privacy by Design.
• Provide guidance on secure coding, threat modeling, and secure architecture reviews.
• Generate regular security and risk reports for technical and executive audiences.
• Collaborate with auditors and draft security policies and procedures as needed.
• Partner with IT, Privacy, Compliance, and business units to reduce risk.

Skills

Application security

DevSecOps

Code review

Threat modeling

Security by Design

Cross-functional collaboration

Education

Bachelor's degree in Computer Science or related field

Tools

SonarQube

Burp Suite

Job description

An organization is seeking an Application Security Engineer to build and mature its application security program, embedding security across the software development lifecycle (SDLC) and championing Security by Design principles. As a leader in clinical genetic testing, the organization handles highly sensitive patient data across its web, API, and pipeline applications, and this role is central to protecting that data and reducing risk. The engineer will implement and manage static and dynamic code analysis tooling — including SonarQube and BURP — partner closely with engineering to remediate findings, and help close audit-identified gaps in secure coding, software composition analysis, and code review coverage. This role directly supports HIPAA compliance and organizational risk reduction; scope may evolve as organizational needs change.

Key Responsibilities

• Implement and manage static and dynamic code analysis, integrating SonarQube (and complementary SAST/DAST/SCA tools) into CI/CD pipelines and check-in scans, and partner with engineering to triage and remediate findings.
• Perform penetration tests and vulnerability assessments across web, API, and pipeline applications, and lead consistent, timely remediation of identified findings.
• Develop and maintain a structured remediation program that addresses and resolves security findings quickly, consistently, and in priority order.
• Evolve the organization's SDLC into a Secure SDLC (SSDLC) by embedding Security by Design and Privacy by Design principles at every stage.
• Integrate secure coding practices with development teams, providing guidance, threat modeling, and secure architecture reviews for new features and releases.
• Generate regular reports on the status of application security initiatives, vulnerability management, and risk assessments for technical and executive audiences.
• Collaborate with auditors during internal and external audits, providing explanations, evidence, and documentation, and draft security policies and procedures as needed.
• Partner cross-functionally with IT, Privacy, Compliance, and business units to support initiatives and drive measurable risk reduction.

Required Experience & Skills

• Bachelor's degree in Computer Science, Cybersecurity, Information Security, or a related field — or an equivalent combination of education and experience.
• Minimum of 3–5 years of experience in application security, DevSecOps, or software engineering with a security focus.
• Hands-on experience with SonarQube for static code analysis and code quality/security gating.
• Experience with SAST, DAST, SCA, and IAST tooling and integrating them into CI/CD pipelines.
• Familiarity with penetration testing, code review, and vulnerability management processes.
• Understanding of compliance frameworks and regulations relevant to healthcare data, including HIPAA, NIST, and GDPR.
• Excellent written and verbal communication skills, with the ability to translate technical risk for non-technical stakeholders and collaborate cross-functionally.
• Detail-oriented, self-directed, and able to prioritize in a fast-moving environment.

Nice to Have

• Relevant industry certifications such as OSCP, CSSLP, GWAPT, CISSP, or equivalent.
• Experience securing web applications, APIs, and cloud-native/containerized workloads.
• Knowledge of authentication and authorization frameworks (e.g., SAML, OAuth, OpenID Connect).
• Prior experience in a healthcare, clinical laboratory, or other regulated (HIPAA/PHI) environment.

Equal Opportunity Statement:

BigRio is an equal-opportunity employer. We prohibit discrimination and harassment of any kind based on race, religion, national origin, sex, sexual orientation, gender identity, age, pregnancy, disability status, veteran status, or any other protected characteristic as outlined by applicable laws. Hiring decisions are based solely on qualifications, merit, and business needs.