Application Security Engineer - Secure Code Review
The Elite Job
A complete application in a minute
Tailored resume and cover letter, ready to send.
Job summary
The Elite Job is seeking an Application Security Engineer focused on Secure Code Review to strengthen software security across the SDLC. You will perform manual and automated reviews, identify vulnerabilities, and work with developers, DevOps, QA, and security teams to remediate findings.
Ideal candidates understand OWASP Top 10, secure coding practices, and security testing tools. This role supports a security-focused engineering environment and continuous improvement of development processes.
Qualifications
- Bachelor's degree in Computer Science, Information Technology, Software Engineering, Cybersecurity, or equivalent.
- Equivalent practical experience or relevant training may be considered.
- Additional cybersecurity certifications are desirable but not mandatory.
Responsibilities
- Conduct manual and automated source code reviews to identify security vulnerabilities.
- Identify security weaknesses and remediation strategies.
- Apply OWASP guidance to assess controls and improvements.
- Provide secure coding guidance to developers to fix findings.
- Configure and interpret SAST/DAST findings during SDLC.
- Collaborate with DevOps and QA to validate fixes.
- Participate in threat modeling and security architecture reviews.
- Review APIs for access control and data exposure issues.
Skills
Education
Tools
Job description
The Elite Job is seeking a skilled and detail-oriented Application Security Engineer – Secure Code Review to strengthen application security, identify vulnerabilities in software code, and help development teams build secure, reliable, and resilient applications. This role is ideal for professionals who are passionate about cybersecurity, secure software development, vulnerability assessment, and risk reduction throughout the software development lifecycle.
The successful candidate will conduct manual and automated source code reviews, identify security weaknesses, evaluate application architecture, and recommend practical remediation strategies. Working closely with software developers, DevOps engineers, quality assurance teams, and security specialists, the Application Security Engineer will help prevent security vulnerabilities before applications are deployed into production.
The role requires a strong understanding of common application security risks, programming languages, secure coding practices, and industry-recognized security standards. The ideal candidate should be analytical, proactive, and capable of translating complex security findings into clear, actionable recommendations that development teams can implement efficiently.
At The Elite Job, this position offers an opportunity to contribute to a security-focused engineering environment where protecting sensitive information, improving software quality, and promoting secure development practices are essential priorities.
Secure Source Code Review: Conduct comprehensive manual and automated code reviews to identify security vulnerabilities, insecure coding patterns, authentication weaknesses, authorization flaws, and potential data exposure risks.
Vulnerability Identification: Detect common application security issues, including SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), insecure deserialization, server-side request forgery (SSRF), and improper input validation.
OWASP Security Assessment: Apply relevant OWASP guidance, including the OWASP Top 10 and OWASP Application Security Verification Standard (ASVS), to assess application security controls and identify areas requiring improvement.
Secure Coding Guidance: Provide developers with practical recommendations, secure coding examples, and remediation guidance to address vulnerabilities without unnecessarily disrupting development schedules.
Static Application Security Testing (SAST): Configure, operate, and interpret findings from static analysis tools to identify potential vulnerabilities early in the software development lifecycle.
Dynamic Application Security Testing (DAST): Collaborate with testing teams to evaluate running applications for security weaknesses and validate findings through controlled testing.
Threat Modeling: Participate in threat modeling exercises to identify potential attack paths, assess application risks, and recommend suitable preventive and detective security controls.
Security Architecture Review: Evaluate application designs, APIs, authentication mechanisms, access controls, data flows, and third-party integrations to identify architectural security concerns.
API Security: Review REST APIs, GraphQL endpoints, and other service interfaces for broken access controls, excessive data exposure, insecure authentication, and inadequate rate limiting.
Dependency and Third-Party Risk Management: Assess third-party libraries, open-source components, and software dependencies for known vulnerabilities and recommend appropriate upgrades or mitigations.
CI/CD Security Integration: Work with DevOps and platform engineering teams to incorporate security checks into continuous integration and continuous delivery pipelines.
Vulnerability Reporting: Document findings with clear descriptions, severity ratings, affected components, potential business impact, reproducible evidence where appropriate, and recommended remediation steps.
Remediation Verification: Reassess updated code to confirm that reported vulnerabilities have been addressed effectively and that corrective changes have not introduced additional security issues.
Security Standards and Compliance: Support internal security assessments and relevant compliance initiatives by maintaining review records, technical evidence, and remediation documentation.
Security Awareness: Educate developers and technical stakeholders on secure coding standards, common attack techniques, and practical approaches to preventing recurring vulnerabilities.
Continuous Improvement: Monitor emerging application security threats, review new testing methodologies, and recommend improvements to security tools, processes, and engineering standards.
Bachelors degree in Computer Science, Information Technology, Software Engineering, Cybersecurity, or a related technical discipline.
Equivalent practical experience, relevant professional training, or demonstrated technical expertise may also be considered.
Additional cybersecurity qualifications or certifications are desirable but not mandatory where strong practical experience can be demonstrated.
- Strong understanding of secure software development principles and the software development lifecycle.
- Proficiency in at least one programming language, such as Java, Python, JavaScript/TypeScript, C#, Go, PHP, or C/C++.
- Practical knowledge of web application technologies, HTTP/HTTPS, REST APIs, databases, and common application architectures.
- Experience reviewing source code for security weaknesses and identifying vulnerabilities that automated tools may overlook.
- Knowledge of OWASP Top 10 risks, secure authentication, authorization, session management, cryptography fundamentals, and secure data handling.
- Familiarity with static and dynamic application security testing tools, such as SonarQube, Checkmarx, Fortify, Semgrep, or Burp Suite.
- Understanding of common vulnerability classifications, including the Common Vulnerabilities and Exposures (CVE) system and Common Weakness Enumeration (CWE).
- Knowledge of dependency scanning, secrets detection, software composition analysis, and secure configuration practices.
- Familiarity with Git, code repositories, pull requests, and collaborative software development workflows.
- Understanding of cloud application security, container security, and CI/CD pipeline controls is an advantage.
- Excellent analytical thinking and problem-solving abilities.
- Strong attention to detail when examining complex codebases and technical findings.
- Clear written and verbal communication skills.
- Ability to explain technical vulnerabilities and business risks to developers, managers, and non-technical stakeholders.
- Effective time management and the ability to prioritize vulnerabilities according to severity and business impact.
- Strong collaboration skills and a commitment to continuous learning.
- Professional integrity and respect for confidentiality when handling sensitive source code, credentials, and security information.
The Elite Job welcomes candidates with different levels of professional experience, depending on the positions technical requirements and project needs.
Basic knowledge of programming, web technologies, databases, and cybersecurity principles.
Familiarity with secure coding concepts and common application vulnerabilities.
Academic projects, cybersecurity labs, personal projects, internships, or practical training demonstrating application security knowledge.
Willingness to learn source code review methodologies, vulnerability assessment techniques, and security testing tools.
Approximately 2–5 years of experience in application security, software development, penetration testing, security testing, or a related technical role.
Demonstrated experience conducting code reviews and identifying vulnerabilities in web applications, APIs, or enterprise software.
Practical experience using security testing tools and helping development teams remediate findings.
Ability to prioritize security issues, document findings, and verify corrective actions.
Typically 5 or more years of relevant experience in application security engineering, secure code review, or software security.
Experience defining secure coding standards, improving application security processes, and mentoring developers or security analysts.
Strong knowledge of threat modeling, security architecture, vulnerability management, and automated security testing.
Experience integrating security controls into enterprise development workflows and CI/CD pipelines.
Experience requirements may vary according to the specific vacancy. Candidates should apply based on their actual skills, relevant achievements, and ability to meet the roles responsibilities.
The working schedule will depend on project requirements, client expectations, and the employment arrangement agreed upon during recruitment.
- Employment Type: Full-time, subject to the specific vacancy.
- Standard Schedule: Typically 40 hours per week, depending on the applicable employment arrangement and local regulations.
- Working Days: Generally Monday to Friday, with flexibility according to team and project needs.
- Work Location: Remote, hybrid, or office-based, depending on the advertised position.
- Flexible Scheduling: Flexible working arrangements may be available where business requirements permit.
- Meetings and Collaboration: Participation in code review discussions, security planning sessions, sprint meetings, and cross-functional technical reviews.
- Additional Hours: Occasional schedule adjustments may be necessary during critical security incidents, urgent remediation activities, or major application releases.
- Final working hours, time-zone expectations, leave policies, and remote-work eligibility will be communicated during the recruitment process.
Ability to recognize insecure coding practices and understand how they may be exploited.
Knowledge of common web application attacks, API vulnerabilities, and application-layer security controls.
Understanding of secure software architecture, security design principles, and defense-in-depth strategies.
Familiarity with OWASP guidance and secure development frameworks.
Awareness of privacy principles, data protection requirements, and relevant security compliance obligations.
Ability to analyze source code, trace data flows, identify trust boundaries, and recognize potential attack paths.
Capability to distinguish genuine vulnerabilities from false positives generated by automated tools.
Ability to assess vulnerability severity based on exploitability, impact, application exposure, and business context.
Skill in producing clear, reproducible security findings with practical remediation recommendations.
Ability to verify fixes and support developers in implementing effective security controls.
Ability to work with source control systems, development environments, application logs, and security testing tools.
Understanding of database security, encryption fundamentals, secrets management, and access control mechanisms.
Ability to evaluate application dependencies and assess risks associated with third‑party components.
Familiarity with cloud platforms, containers, and infrastructure security is beneficial.
Ability to research unfamiliar technologies and adapt security review techniques to new application environments.
Communicate security findings constructively without unnecessarily delaying software delivery.
Collaborate with developers, architects, testers, operations teams, and business stakeholders.
Maintain accurate records of code reviews, vulnerabilities, remediation progress, and security recommendations.
Demonstrate sound judgment, professional discretion, and a responsible approach to sensitive security information.
Remain current with evolving threats, security tools, industry guidance, and secure development practices.
The Elite Job aims to provide a professional working environment that supports technical development, collaboration, and long‑term career growth. Benefits and eligibility will depend on the specific employment arrangement and applicable company policies.
Potential benefits may include:
- Competitive Compensation: Salary or compensation aligned with experience, technical expertise, role scope, and applicable market conditions.
- Professional Development: Opportunities to develop expertise in application security, secure code review, vulnerability management, and security architecture.
- Technical Training: Access to relevant learning resources, security workshops, and technical knowledge‑sharing sessions where available.
- Certification Support: Potential support for recognized cybersecurity certifications, subject to company policy and eligibility.
- Flexible Work Arrangements: Remote or hybrid options where offered for the specific position.
- Collaborative Environment: Opportunities to work with software developers, security professionals, and technology teams on practical security challenges.
- Career Advancement: Opportunities to progress toward senior application security, security architecture, product security, or security leadership positions.
- Meaningful Technical Work: The opportunity to help prevent vulnerabilities and improve the security and reliability of software applications.
- Work‑Life Balance: Working arrangements designed to support sustainable productivity, subject to project demands, and agreed schedules.
Specific benefits, paid leave, insurance, bonuses, equipment provisions, and other employment terms will be confirmed in the official offer, where applicable.
Your work will help identify vulnerabilities before they become serious incidents, protect sensitive information, and improve the reliability of business‑critical applications.
The role provides opportunities to use programming knowledge, analytical skills, security testing techniques, and code review methodologies to solve practical engineering challenges.
Work with development, DevOps, quality assurance, and security professionals to integrate security into everyday engineering decisions and promote a shared responsibility for secure software.
Build deeper knowledge of application security testing, threat modeling, API protection, secure architecture, and automated security controls as technologies and threats evolve.
Help refine code review practices, improve security testing coverage, reduce recurring vulnerabilities, and encourage secure coding habits throughout development teams.
Develop the skills needed to pursue advanced roles in application security engineering, product security, security architecture, penetration testing, or cybersecurity leadership, depending on experience and organizational opportunities.
The Elite Job is looking for professionals who combine technical curiosity with a responsible, practical, and collaborative approach to cybersecurity.
'/%3e%3cpath%20d='M101.744%2012.4726L102.894%2016.1947L99.0021%2013.2201L101.744%2012.4726ZM105.3%208.40937H100.488L99.0026%203.59473L97.5116%208.41047L92.7%208.40385L96.5965%2011.3834L95.1055%2016.1942L99.0021%2013.2196L101.408%2011.3834L105.3%208.40992V8.40937Z'%20fill='white'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_5593_1381'%20x1='90'%20y1='9.44471'%20x2='99'%20y2='9.44471'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%2300AD70'/%3e%3cstop%20offset='0.998594'%20stop-color='%2300B67A'/%3e%3cstop%20offset='1'%20stop-color='%23DCDCE6'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e){kind=small}
