Application Security Engineer - Mid-Atlantic region (Remote in VA, MD, PA, NC, DE, NJ, or DC)

MedStar Health; Maryland; Remote; USD 90,000 - 130,000; Full time

Job summary

A leading healthcare organization seeks an Application Security Engineer to support their cybersecurity initiatives. This role involves implementing security tools, working with CI/CD pipelines, and ensuring secure coding practices. Candidates should possess substantial security engineering experience and a relevant degree, offering the chance to work remotely while contributing to essential projects.

Benefits

Remote work options

Insurance options

Holidays and allowances

Retirement plans

Qualifications

• 3-5 years of security engineering experience required.
• Familiarity with various SAST, IAST, DAST tools is preferred.
• Knowledge integrating security into development processes is a plus.

Responsibilities

• Implementing and troubleshooting Static Application Security Testing tools.
• Engaging in full-stack software engineering with modern technologies.
• Applying security fundamentals throughout the Software Development Life Cycle.

Skills

Application Security Fundamentals

CI/CD Pipeline Knowledge

Scripting

Full-Stack Development

Secure Coding Practices

Education

Bachelor's degree or equivalent experience

Tools

Snyk

Burp Suite

Semgrep

CodeQL

Azure DevOps

Job description

Application Security Engineer - Mid-Atlantic region (Remote in VA, MD, PA, NC, DE, NJ, or DC)

GuidePoint Security provides trusted cybersecurity expertise, solutions, and services that help organizations make better decisions and minimize risk. By taking a three-tiered, holistic approach for evaluating security posture and ecosystems, GuidePoint enables some of the nation's top organizations, such as Fortune 500 companies and U.S. government agencies, to identify threats, optimize resources, and integrate best-fit solutions that mitigate risk.

Location: United States, Maryland

Responsibilities include:

• Implementing, operationalizing, and troubleshooting Snyk's Static Application Security Testing (SAST) tools
• Understanding and working with CI/CD pipeline tools and processes (e.g., GitHub Actions, GitLab Runners, Azure DevOps, Jenkins, CircleCI)
• Engaging in software engineering, ideally full-stack development with modern technologies and architectures
• Developing scripts and automations using programming languages
• Applying application security fundamentals, including OWASP Top 10, threat modeling, and secure coding practices throughout the SDLC

Preferred qualifications:

• Experience with other SAST tools such as Semgrep, CodeQL, Checkmarx, Veracode
• Writing or customizing SAST rules (Semgrep or CodeQL)
• Knowledge of additional security tools like IAST, DAST, API security, SCA
• Familiarity with API security tools (e.g., NoName, Traceable, Salt, Cequence)
• Proficiency with vulnerability validation and tools like Burp Suite
• Knowledge of Secure Development Lifecycles and vulnerability remediation
• Experience integrating security into CI/CD pipelines and development processes

Educational & professional credentials:

• Bachelor's degree or equivalent experience in a relevant field
• 3-5 years of security engineering experience in the industry

Additional notes: The posting indicates the use of Greenhouse Software and Zoom Scheduler for applications and scheduling. The company emphasizes its growth, core values, and benefits, including remote work, insurance options, holidays, allowances, and retirement plans.