Application Security Engineer: Build Secure SDLC at Scale

OpenKrill; United States; Remote; USD 120,000 - 190,000; Full time

Job summary

VGS is seeking an Application Security Engineer to partner with Security and Engineering to build a developer-centric security program. You will shape Secure SDLC, automate guardrails in CI/CD, scale our private bug bounty, and cultivate a Security Champions network across a globally distributed team.

You will lead threat modeling, perform threat modeling and reviews for Java and Python microservices, and push security excellence across the engineering org.

Qualifications

• 3-5+ years in Application Security or secure software development.
• Proven hands-on security assessments for Java/Python.
• Experience integrating SAST/DAST tools into CI/CD.
• Experience managing bug bounty programs and security metrics.
• Knowledge of STRIDE or equivalent threat modeling frameworks.

Responsibilities

• Automate security controls in CI/CD pipelines (SAST/DAST/SCA).
• Define and drive Secure SDLC processes and threat modeling practices.
• Lead private bug bounty programs, triage reports, and track MTTR metrics.
• Conduct threat modeling and code reviews for microservices in Java/Python.
• Develop secure coding training and foster Security Champions network.
• Coordinate appsec reviews and security culture with engineering teams.

Skills

AppSec experience

Secure SDLC

Threat modeling

Cross-team collaboration

Security tooling & automation

Education

Bachelor's degree

Tools

GitHub Advanced Security

ZAP

Burp Suite

Veracode

Semgrep

Job description

VGS is seeking an Application Security Engineer to partner with Security and Engineering to build a developer-centric security program. You will shape Secure SDLC, automate guardrails in CI/CD, scale our private bug bounty, and cultivate a Security Champions network across a globally distributed team.

You will lead threat modeling, perform threat modeling and reviews for Java and Python microservices, and push security excellence across the engineering org.