Application Security Engineer

Yum! Brands; United States; Remote; USD 110.000 - 170.000; Vollzeit

Zusammenfassung

Yum! Brands is seeking an Application Security Engineer to partner with US teams, guiding security as a subject matter expert on applications.

You will collaborate with third-party engineers and product owners to identify, prioritize, and remediate vulnerabilities in web and mobile apps, while maintaining SAST/DAST/SCA and container security profiles. The role emphasizes SSDLC practices, secure coding, and proactive security campaigns.

Qualifikationen

• Bachelor's degree required; four+ years in cybersecurity, software engineering, or app development.
• Experience evaluating vulnerabilities for exploitability and business risk.
• Familiarity with SSDLC practices and secure coding standards.
• Knowledge of CI/CD pipelines and Git-based development workflows.
• Knowledge of SAST/DAST/SCA testing methods and secrets detection.
• Understanding of OWASP Top 10 and modern authentication tech.

Aufgaben

• Provide security guidance as a SME on applications for US teams.
• Identify and remediate vulnerabilities with third-party engineers and product owners.
• Review findings and communicate remediation plans to engineering teams.
• Maintain application security scan profiles across SAST/DAST/SCA, container security, IaC.
• Integrate security into the SDLC and automate tests.
• Lead awareness campaigns for secure software development.
• Monitor vulnerabilities in dependencies and coordinate incident root-cause analyses.

Kenntnisse

SSDLC

OWASP Top 10

CI/CD pipelines

Git workflows

Vulnerability assessment

Secure coding

OAuth 2.0 / OIDC / SAML / JWT

Container security

Ausbildung

Bachelor's degree

Tools

Docker

Kubernetes

Terraform

CloudFormation

Jobbeschreibung

Responsibilities

• Partner with US teams to provide security guidance as a subject matter expert around application security
• Collaborate with third-party engineers and product owners to identify, prioritize, and remediate vulnerabilities in mobile and web applications
• Review vulnerability findings and work with engineering teams to communicate and remediate security issues
• Maintain application security scan profiles and policies across SAST, DAST, SCA, container security, and IaC
• Integrate security into the software development lifecycle (SDLC), including secure coding practices and automated testing
• Conduct awareness campaigns to promote secure software development practices
• Monitor publicly disclosed vulnerabilities affecting applications and third-party dependencies
• Coordinate with incident response teams to perform root cause analysis on application security incidents

Requirements

• Bachelor's degree and at least four years of experience in cybersecurity, software engineering, or application development
• Experience evaluating application security vulnerabilities for exploitability and business risk
• Familiarity with secure software development lifecycle (SSDLC) practices
• Knowledge of Git-based development workflows and CI/CD pipelines
• Knowledge of application security testing methodologies (SAST, DAST, SCA, secrets detection)
• Knowledge of secure coding principles and OWASP Top 10
• Knowledge of modern authentication technologies (OAuth 2.0, OIDC, SAML, JWT)
• Knowledge of containers and container management (Docker, Kubernetes)
• Knowledge of Infrastructure as Code (Terraform, CloudFormation)

Preferred Qualifications

• Experience developing software in modern programming languages (Java, Python, Go, etc.)
• Experience securing applications within Git-based DevSecOps environments
• Experience integrating application security controls into CI/CD pipelines
• Familiarity with AI-assisted software development tools