Application Security Engineer - Secure NYC Software

New York City Office of Technology & Innovation; New York (NY); On-site; USD 110,000 - 140,000; Full time

Job summary

New York City Office of Technology & Innovation (OTI) Cyber Command is seeking a Cybersecurity Engineer (Application Security) to safeguard the city’s digital infrastructure. The role focuses on identifying and mitigating security risks in software applications, supporting SSAP, and using SAST/DAST and SCA tools to monitor third‑party components across city agencies.

You will work with mentors to apply secure coding practices and stay current with OWASP guidelines while collaborating with

Qualifications

• A baccalaureate degree and four years of satisfactory full‑time experience related to projects and policies required by the position.
• Experience with SAST/DAST/SCA tools is preferred.
• Familiarity with OWASP Top 10 and secure coding concepts.
• Understanding of cloud concepts (AWS, Azure, GCP) and web API security practices.

Responsibilities

• Participate in the daily execution of the Software Security Assurance Program (SSAP) to ensure applications meet security standards prior to deployment.
• Assist with SAST and DAST security testing to identify vulnerabilities in citywide applications.
• Utilize SCA tools to identify, track, and report vulnerabilities in open-source and third-party components.
• Serve as a point of contact between developers and security teams to integrate security requirements into development workflows.
• Perform foundational security reviews of cloud vendor applications to verify compliance with city security guidelines.
• Help provide guidance and training materials to development teams based on secure coding standards and OWASP guidelines.
• Assist in updating and maintaining security documentation, guidelines, and compliance tracking frameworks (e.g., NIST, CIS, OWASP).
• Stay informed on emerging cybersecurity threats and participate in team mentorship to expand application security expertise.

Skills

SAST/DAST/SCA tools

OWASP Top 10

Cloud concepts (AWS/Azure/GCP)

Web API security (OAuth/REST)

Education

Bachelor's degree

Tools

Veracode

Checkmarx

Snyk

Burp Suite

Job description

New York City Office of Technology & Innovation (OTI) Cyber Command is seeking a Cybersecurity Engineer (Application Security) to safeguard the city’s digital infrastructure. The role focuses on identifying and mitigating security risks in software applications, supporting SSAP, and using SAST/DAST and SCA tools to monitor third‑party components across city agencies.

You will work with mentors to apply secure coding practices and stay current with OWASP guidelines while collaborating with