Application Security Engineer - DevSecOps (Hybrid)

Purpose Brands, LLC; Seattle (WA); Hybrid; USD 120.000 - 160.000; Vollzeit

Benefits dieser Stelle

Hybrid Work Environment

Medical, Dental and Vision Coverage

401(K) Savings Plan Matching at 4%

Unlimited Time off

In‑house workout facilities

Zusammenfassung

Purpose Brands LLC, Seattle, WA, is seeking an Application Security Engineer to join our DevSecOps team. You will embed security controls, automate security testing, and drive secure development practices across cloud-based applications in AWS and Azure.

You will partner with software engineering, DevOps, and cloud teams to mature security processes, improve vulnerability detection, and reduce risk without slowing delivery, focusing on hands‑on security engineering and developer enablement.

Qualifikationen

• Bachelor’s degree in Computer Science, Information Systems, Engineering, or a related field.
• 3–5 years of experience in application security, security engineering, or software engineering with a strong security focus.
• Hands‑on experience performing code reviews and application security testing across modern languages, frameworks, and APIs.
• Experience working with application security tools such as SAST, DAST, and dependency scanning (e.g., GitHub Dependabot or similar).
• Strong understanding of OWASP Top 10, secure coding principles, authentication/authorization, and API security.
• Practical experience supporting applications running in AWS and/or Azure cloud environments.
• Familiarity with CI/CD pipelines, DevOps workflows, and DevSecOps concepts.
• Ability to communicate security risks and remediation guidance clearly to developers and non‑security stakeholders.
• Strong analytical skills with the ability to balance security risk with delivery velocity.

Aufgaben

• Embed application security practices into all phases of the software development lifecycle (SDLC), from design through deployment and maintenance.
• Perform application security assessments including static code analysis (SAST), dynamic testing (DAST), and software composition analysis (SCA).
• Develop and maintain threat models for critical systems and applications, collaborating with engineering teams to identify threats, assess risk, and drive remediation efforts.
• Promote secure coding practices and contribute to secure development standards aligned with OWASP and industry best practices.
• Partner with engineering and DevOps teams to integrate security tooling into CI/CD pipelines, enabling automated and repeatable security testing.
• Analyze and manage vulnerability findings from tools such as GitHub Advanced Security, Syft, Clair, Qualys, etc.
• Help tune security tooling to reduce false positives and improve signal quality for development teams.
• Assist in the adoption of security automation to improve consistency, efficiency, and scalability across application environments.
• Assist in securing applications deployed across AWS and Azure, including workloads running on IaaS, PaaS, and container-based platforms.
• Identify risks to the confidentiality, integrity, and availability of application data hosted in cloud-based environments.
• Collaborate with cloud and platform security engineers to ensure application security controls align with broader cloud security architecture.
• Own and curate security controls within the Cloud Engineering and Platform Engineering space that align with security frameworks and controls like NIST CSF, CIS Benchmarks, and CSA CCM.
• Triage, prioritize, and track remediation of application vulnerabilities based on risk and business impact.
• Assist in security investigations involving application vulnerabilities or security events.
• Participate in periodic reviews of application security controls to validate effectiveness and compliance with organizational standards.
• Act as a security partner to engineering teams by providing guidance, education, and actionable recommendations.
• Contribute to the continuous improvement of application security processes, standards, and metrics.
• Support governance, risk management, and compliance initiatives as they relate to application security.

Kenntnisse

Code reviews

Application security testing

OWASP Top 10

Cloud security (AWS/Azure)

CI/CD / DevSecOps

Security tooling

Communication

Ausbildung

Bachelor’s degree in Computer Science, Information Systems, Engineering, or a related field

Tools

GitHub Dependabot

SAST tooling

DAST tooling

Dependency scanning

Jobbeschreibung

Purpose Brands LLC, Seattle, WA, is seeking an Application Security Engineer to join our DevSecOps team. You will embed security controls, automate security testing, and drive secure development practices across cloud-based applications in AWS and Azure.

You will partner with software engineering, DevOps, and cloud teams to mature security processes, improve vulnerability detection, and reduce risk without slowing delivery, focusing on hands‑on security engineering and developer enablement.