Application Security Engineer — SDLC Automation & Vetting

Newfold Digital; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Work-life balance

Diversity and inclusion culture

HMO benefits

Punctuality Bonus

Generous vacation policy

Job summary

Newfold Digital is seeking an Application Security Engineer to run and scale our day-to-day AppSec program. You will operate scanning tools across the SDLC, triage findings, and collaborate with engineering teams to fix vulnerabilities.

The role emphasizes scripting basics, strong attention to detail, and the ability to manage multiple toolchains while contributing to runbooks and process improvements. Join a team focused on robust security across Bluehost, HostGator, Domain.com, and more.

Qualifications

• 2–4 years in application security, security engineering, or related role.
• Working knowledge of common vulnerability classes (OWASP Top 10) and secure SDLC practices.
• Basic scripting ability (Python preferred) for automating repetitive tasks.
• Comfortable communicating findings clearly to developers.
• Strong attention to detail and ability to manage a queue of findings across multiple tools.

Responsibilities

• Operate and maintain AppSec scanning tools (SAST, SCA, secrets scanning, container scanning) across the SDLC.
• Triage findings, validate true positives, and prioritize remediation with engineering teams.
• Track vulnerabilities through to closure and monitor SLA compliance.
• Support onboarding of new repositories/services into the security tooling.
• Contribute to internal documentation, runbooks, and process improvements.
• Assist with basic scripting/automation tasks under guidance from senior team members.

Skills

AppSec experience

OWASP Top 10

Python scripting

Communication with developers

Security tooling knowledge

Tools

Defect Dojo

Dependency-Track

Truffle Hog

Trivy

Semgrep

Job description

Newfold Digital is seeking an Application Security Engineer to run and scale our day-to-day AppSec program. You will operate scanning tools across the SDLC, triage findings, and collaborate with engineering teams to fix vulnerabilities.

The role emphasizes scripting basics, strong attention to detail, and the ability to manage multiple toolchains while contributing to runbooks and process improvements. Join a team focused on robust security across Bluehost, HostGator, Domain.com, and more.