Application Security Engineer - DevSecOps Champion

Ascensus; Town of Florida (NY); On-site; USD 120,000 - 150,000; Full time

Job summary

Ascensus is a leading independent technology and service platform powering savings plans across America. We seek an Application Security Engineer to oversee the application security program and partner with scrum teams to embed secure development practices.

You will drive best practices for web and API security, perform architecture reviews, threat modeling, and coordinate SAST/DAST/SCA in CI/CD to protect data and ensure compliance.

Qualifications

• 4+ years in secure software development or DevSecOps.
• Ability to define security requirements and translate risk to business impact.
• Experience with threat modeling and security architecture specifications.
• Experience integrating SAST/DAST and SCA into CI/CD pipelines.
• Familiarity with Burp Suite, Fiddler, OWASP ZAP, Wireshark and Metasploit.
• Knowledge of OWASP Top 10 and secure development standards.
• Understanding SDL, SAMM, or BSIMM frameworks.
• Experience assessing third-party components (open source or commercial).

Responsibilities

• Protect confidential data and ensure secure handling across Ascensus.
• Partner with security and development leadership to embed DevSecOps into SDLC.
• Provide security consultation to scrum teams and technology groups.
• Conduct security analysis including architecture reviews and threat modeling.
• Support deployment and triage of SAST/DAST/SCA findings in CI/CD.
• Assist with additional security initiatives as needed.

Skills

Secure SDLC

Threat modeling

Security architecture

Security testing

SAST/DAST/SCA

OWASP Top 10

.NET/Java knowledge

CI/CD integration

Tools

Burp Suite

Fiddler

OWASP ZAP

Wireshark

Metasploit

Nessus

Qualys

Job description

Ascensus is a leading independent technology and service platform powering savings plans across America. We seek an Application Security Engineer to oversee the application security program and partner with scrum teams to embed secure development practices.

You will drive best practices for web and API security, perform architecture reviews, threat modeling, and coordinate SAST/DAST/SCA in CI/CD to protect data and ensure compliance.