Application Security Engineer — SAST, DAST & CI/CD

Cybersecurity Jobs; New York (NY); On-site; USD 75,000 - 135,000; Full time

Job summary

The City of New York’s Technology & Innovation team seeks an Application Security Engineer, onsite in Brooklyn, NY, to protect critical digital services within the Software Security Assurance Program (SSAP).

You will conduct hands-on security testing (SAST/DAST/SCA), threat modeling, and secure coding guidance while collaborating with agency development teams to reduce vulnerabilities before deployment.

Qualifications

• Bachelor's degree with four years of related experience or an equivalent combination of education and experience.
• 2–4 years of professional experience in application security, penetration testing, or software engineering with a focus on application security.
• Hands-on experience configuring, operating, and tuning SAST, DAST, and SCA tools (e.g., Veracode, Checkmarx, Snyk, Burp Suite) and working with CI/CD pipelines.

Responsibilities

• Execute application security assessments within the SSAP to ensure web apps, APIs, and mobile systems meet city security standards before release.
• Run SAST, DAST, and manual reviews to validate vulnerabilities, reduce false positives, and prioritize issues by risk.
• Operate SCA tools to monitor open-source components and drive remediation.
• Perform threat modeling and logic reviews during design to surface security flaws early.
• Provide remediation guidance and secure coding advice to agency development teams.

Skills

SAST

DAST

SCA

Threat modeling

CI/CD pipelines

GitHub Actions

Azure DevOps

GitLab

Python

Java

JavaScript/TypeScript

C#/.NET

OWASP Top 10

Education

Baccalaureate degree

4 years of full-time experience or equivalent

Tools

Veracode

Checkmarx

Snyk

Burp Suite

Job description

The City of New York’s Technology & Innovation team seeks an Application Security Engineer, onsite in Brooklyn, NY, to protect critical digital services within the Software Security Assurance Program (SSAP).

You will conduct hands-on security testing (SAST/DAST/SCA), threat modeling, and secure coding guidance while collaborating with agency development teams to reduce vulnerabilities before deployment.