Application Security Engineer — Cloud & DevSecOps

600 UMG Recordings Inc; Tennessee; On-site; USD 90,000 - 130,000; Full time

Job summary

Universal Music Group seeks an Application Security Engineer to enhance security across internal apps and cloud services. You will partner with engineering, infrastructure, and product teams to embed secure practices throughout the software lifecycle.

The role requires hands‑on testing (SAST/DAST/SCA), secure coding guidance, and security design reviews in a dynamic, global environment. Collaboration with DevOps is essential.

Qualifications

• Bachelor’s degree in CS, Information Security, Engineering, or equivalent practical experience.
• 5+ years in Application Security or related field.
• Experience with SAST/DAST/SCA and API security testing.
• Knowledge of OWASP Top10 and secure coding practices.
• Experience CI/CD/DevSecOps integrations.
• Experience with AWS/Azure/GCP environments.

Responsibilities

• Perform application security assessments, threat modeling, and secure design reviews for internal and third‑party apps.
• Conduct SAST/DAST/SCA and API security testing; validate findings.
• Review source code and provide secure coding guidance based on OWASP.
• Partner with engineering teams to identify risks and remediation strategies.
• Integrate security testing into CI/CD pipelines and delivery workflows.
• Provide security architecture guidance for new apps, APIs, and cloud services.
• Support investigations and remediation of application‑layer incidents and vulnerabilities.
• Develop reusable security guidance and technical documentation for engineers.

Skills

Security assessments

Threat modeling

Secure coding

CI/CD security

DevSecOps

Cloud security

Collaboration

Education

Bachelor’s degree in CS/Info Security/Engineering

Tools

SAST

DAST

SCA

API security testing

OWASP tools

Burp Suite

Checkmarx/Veracode/GitHub Advanced Security

Job description

Universal Music Group seeks an Application Security Engineer to enhance security across internal apps and cloud services. You will partner with engineering, infrastructure, and product teams to embed secure practices throughout the software lifecycle.

The role requires hands‑on testing (SAST/DAST/SCA), secure coding guidance, and security design reviews in a dynamic, global environment. Collaboration with DevOps is essential.