Application Security Engineer – Public Sector Cyber Defense

City of New York; New York (NY); On-site; USD 75,000 - 95,000; Full time

Job summary

City of New York’s Office of Technology and Innovation seeks a Cybersecurity Engineer (Application Security) to safeguard city software. The role supports the Software Security Assurance Program and uses SAST/DAST to uncover vulnerabilities, while monitoring third-party components with SCA.

You will work with developers and security teams to integrate secure coding, perform security reviews of cloud apps, and mentor staff on OWASP standards.

Qualifications

• A baccalaureate degree and four years of full-time experience related to projects and policies.

Responsibilities

• Participate in the daily execution of the Software Security Assurance Program (SSAP) to ensure applications meet security standards prior to deployment.
• Assist with SAST and DAST security testing to identify vulnerabilities across citywide applications.
• Utilize Software Composition Analysis (SCA) tools to identify, track, and report vulnerabilities in open-source components.
• Serve as a point of contact between developers and security teams to help integrate security requirements into development workflows.
• Perform security reviews of cloud vendor applications to verify compliance with city security guidelines.
• Help provide guidance and training materials to development teams based on secure coding practices and OWASP guidelines.
• Assist in updating and maintaining security documentation, guidelines, and compliance tracking (NIST, CIS, OWASP).
• Stay informed on emerging cybersecurity threats and mentor the team to grow application security expertise.
• Handle special projects and initiatives as assigned.

Education

Bachelor's degree

Job description

City of New York’s Office of Technology and Innovation seeks a Cybersecurity Engineer (Application Security) to safeguard city software. The role supports the Software Security Assurance Program and uses SAST/DAST to uncover vulnerabilities, while monitoring third-party components with SCA.

You will work with developers and security teams to integrate secure coding, perform security reviews of cloud apps, and mentor staff on OWASP standards.