Application Security Engineer — Protect NYC’s Digital Infra

TECHNOLOGY & INNOVATION; New York (NY); On-site; USD 110,000 - 160,000; Full time

Job summary

The Office of Technology and Innovation (OTI) in New York City seeks an Application Security Engineer to protect city systems. You will execute security assessments, perform SAST/DAST/CAST reviews, and guide developers in secure coding.

Join a 24/7 operations team based in Brooklyn, working with CI/CD pipelines and open-source risk management. Strong communication and threat modeling skills required; relevant certifications are a plus.

Qualifications

• 2–4 years of security-focused application experience (security testing or software engineering).
• Experience with SAST/DAST/SCA tools and CI/CD pipelines.
• Knowledge of OWASP Top 10 and secure coding in languages like Python/Java/JavaScript/ C#/.NET.
• API security concepts (REST, OAuth 2.0) and cloud basics.
• Ability to explain vulnerabilities to developers and project teams.
• Certifications such as GWAPT, GWEB, eWPT, PenTest+ or CSSLP are a plus.

Responsibilities

• Execute application security assessments within the SSAP to verify web apps, APIs and mobile systems meet city security standards.
• Perform SAST, DAST, and manual reviews to validate vulnerabilities and prioritize findings.
• Operate SCA tools to monitor open-source component risks and remediation.
• Conduct threat modeling during design to identify security flaws before code is written.
• Provide remediation guidance and secure coding advice to agency developers.
• Assist in configuring automated security scans in CI/CD pipelines (GitHub Actions, Azure DevOps, GitLab).
• Conduct security reviews of third‑party vendor solutions and web APIs (OAuth, REST).
• Contribute to secure coding guidelines and training materials.

Skills

Application security

Penetration testing

Software engineering

CI/CD pipelines

OWASP Top 10

REST APIs

OAuth 2.0

Threat modeling

Communication skills

Certifications

Education

Bachelor's degree

Tools

Veracode

Checkmarx

Snyk

Burp Suite

Job description

The Office of Technology and Innovation (OTI) in New York City seeks an Application Security Engineer to protect city systems. You will execute security assessments, perform SAST/DAST/CAST reviews, and guide developers in secure coding.

Join a 24/7 operations team based in Brooklyn, working with CI/CD pipelines and open-source risk management. Strong communication and threat modeling skills required; relevant certifications are a plus.