Application Security Engineer - SDLC Automation & DevSecOps

JFrog Ltd; United States; On-site; USD 120,000 - 160,000; Full time

Job summary

JFrog Ltd. is seeking an Application Security Engineer to drive security across the SDLC at scale, empower developers, and automate security across CI/CD pipelines in a cloud-native environment.

You will work with Product, Engineering, DevOps, and Security teams on SSDLC automation, vulnerability management, and secure coding practices.

The role requires hands-on coding, threat modeling, and collaboration to embed security early and continuously.

Qualifications

• 6-7 years of experience in AppSec and Product Security.
• Deep knowledge in application security and vulnerabilities.
• Strong coding/scripting background (e.g., Python, Go, Java, JavaScript).
• Hands-on experience with CI/CD pipelines, security tools, and DevSecOps practices.
• Familiarity with cloud-native architectures (cloud, microservices, containers, Kubernetes).
• Understanding of secure coding principles.
• Strong communication and collaboration skills.
• Penetration testing knowledge is a plus.
• Familiarity with ML/AI concepts applied to security is a strong advantage.

Responsibilities

• Assist in the development of internal security tools and AI agents
• Support the design and implementation of SSDLC practices and automated security controls across the CI/CD pipeline
• Contribute to building and operating scalable vulnerability management frameworks across cloud-native services and SaaS products
• Integrate security into Agile and DevOps processes, including threat modeling, SAST, DAST, and SCA
• Develop Internal application security Tools and Automations
• Partner with development and DevOps teams to embed security early and often
• Contribute to secure code reviews and assist with remediation strategies
• Track, triage, and report vulnerabilities across product lines
• Support the adoption of secure development best practices

Skills

AppSec experience

Product Security

Coding in Python/Go/Java/JS

CI/CD security

DevSecOps

Threat modeling

SAST/DAST/SCA

Cloud/microservices/Kubernetes

Vulnerability management

Security tooling

communication

collaboration

Job description

JFrog Ltd. is seeking an Application Security Engineer to drive security across the SDLC at scale, empower developers, and automate security across CI/CD pipelines in a cloud-native environment.

You will work with Product, Engineering, DevOps, and Security teams on SSDLC automation, vulnerability management, and secure coding practices.

The role requires hands-on coding, threat modeling, and collaboration to embed security early and continuously.