Application Security Technical Lead (Remote)

Kforce Inc; Draper (UT); On-site; USD 140,000 - 190,000; Full time

Job summary

Kforce Inc in Draper, Utah seeks a seasoned Application Security Engineering Lead to direct two remediation teams, align with security, engineering, and product, and drive secure coding standards across the release pipeline.

You will leverage AI-assisted tools to analyze legacy dependencies, generate tests, mentor leads, and communicate risk to executives while ensuring remediation is verified through review, testing, and validation.

Qualifications

• 10+ years of software engineering experience, including 5+ years leading application security remediation.
• Deep Microsoft-stack experience including .NET Framework/modern .NET, C#, ASP.NET MVC/ASPX/Razor.
• Hands-on application security remediation experience, including OWASP Top 10 and CWE/CVE findings.
• Experience with SAST, DAST, software composition analysis (SCA), secure SDLC, DevSecOps, and CI/CD security controls.
• Ability to analyze application architecture and dependencies to determine upstream/downstream impacts of vulnerabilities and proposed fixes.
• Practical experience applying AI to software engineering, including context/prompt design, output validation, governed tool usage, and human review of AI-generated recommendations or code.
• Understanding of security/privacy considerations when using AI tools with sensitive data, including PHI, PII, credentials, and secrets.
• Ability to make sound technical decisions when scanner findings, AI recommendations, application context, and operational requirements conflict.
• Strong communication skills with the ability to explain technical risk, remediation decisions, progress, trade-offs, and capacity needs to technical and non-technical stakeholders.

Responsibilities

• Lead technical direction across two application security remediation teams and serve as the escalation point for complex vulnerabilities, architecture issues, dependencies, and release constraints.
• Partner with security, engineering, application, and product to prioritize vulnerabilities based on risk, exposure, business impact, dependencies, and release readiness.
• Establish remediation standards for secure coding, code reviews, testing, CI/CD controls, releases, and vulnerability closure.
• Analyze findings within the broader application architecture to identify dependencies and determine appropriate remediation strategies.
• Use AI-assisted engineering tools to analyze code, understand legacy dependencies, recommend fixes, generate tests, and prepare changes for human review.
• Guide unit, functional, regression, and security testing to ensure fixes address vulnerabilities without impacting expected functionality.
• Ensure findings are not closed until code review, validation, testing, release confirmation, and supporting evidence are complete.
• Develop reusable secure coding patterns, remediation approaches, and AI-enabled resources to improve consistency and efficiency.
• Identify cross-team risks, dependencies, blockers, and capacity constraints while communicating progress and recommendations to technical and executive stakeholders.
• Mentor technical leads and establish repeatable processes that enable teams to operate independently.

Job description

Responsibilities

• Lead technical direction across two application security remediation teams and serve as the escalation point for complex vulnerabilities, architecture issues, dependencies, and release constraints


• Partner with security, engineering, application, and product to prioritize vulnerabilities based on risk, exposure, business impact, dependencies, and release readiness


• Establish remediation standards for secure coding, code reviews, testing, CI/CD controls, releases, and vulnerability closure


• Analyze findings within the broader application architecture to identify dependencies and determine appropriate remediation strategies


• Use AI-assisted engineering tools to analyze code, understand legacy dependencies, recommend fixes, generate tests, and prepare changes for human review


• Guide unit, functional, regression, and security testing to ensure fixes address vulnerabilities without impacting expected functionality


• Ensure findings are not closed until code review, validation, testing, release confirmation, and supporting evidence are complete


• Develop reusable secure coding patterns, remediation approaches, and AI-enabled resources to improve consistency and efficiency


• Identify cross-team risks, dependencies, blockers, and capacity constraints while communicating progress and recommendations to technical and executive stakeholders


• Mentor technical leads and establish repeatable processes that enable teams to operate independently

Responsibilities

• Lead technical direction across two application security remediation teams and serve as the escalation point for complex vulnerabilities, architecture issues, dependencies, and release constraints


• Partner with security, engineering, application, and product to prioritize vulnerabilities based on risk, exposure, business impact, dependencies, and release readiness


• Establish remediation standards for secure coding, code reviews, testing, CI/CD controls, releases, and vulnerability closure


• Analyze findings within the broader application architecture to identify dependencies and determine appropriate remediation strategies


• Use AI-assisted engineering tools to analyze code, understand legacy dependencies, recommend fixes, generate tests, and prepare changes for human review


• Guide unit, functional, regression, and security testing to ensure fixes address vulnerabilities without impacting expected functionality


• Ensure findings are not closed until code review, validation, testing, release confirmation, and supporting evidence are complete


• Develop reusable secure coding patterns, remediation approaches, and AI-enabled resources to improve consistency and efficiency


• Identify cross-team risks, dependencies, blockers, and capacity constraints while communicating progress and recommendations to technical and executive stakeholders


• Mentor technical leads and establish repeatable processes that enable teams to operate independently

Requirements

• 10+ years of software engineering experience, including 5+ years leading application security remediation, secure modernization, or multiple engineering workstreams


• Deep Microsoft-stack experience, including .NET Framework/modern .NET, C#, ASP.NET MVC/ASPX/Razor, REST APIs, SQL Server, T-SQL/stored procedures, Git, and Azure DevOps


• Hands‑on application security remediation experience, including OWASP Top 10 and CWE/CVE-based findings


• Experience with SAST, DAST, software composition analysis (SCA), secure SDLC, DevSecOps, and CI/CD security controls


• Ability to analyze application architecture and dependencies to determine upstream/downstream impacts of vulnerabilities and proposed fixes


• Practical experience applying AI to software engineering, including context/prompt design, output validation, governed tool usage, and human review of AI-generated recommendations or code


• Understanding of security/privacy considerations when using AI tools with sensitive data, including PHI, PII, credentials, and secrets


• Ability to make sound technical decisions when scanner findings, AI recommendations, application context, and operational requirements conflict


• Strong communication skills with the ability to explain technical risk, remediation decisions, progress, trade‑offs, and capacity needs to technical and non-technical stakeholders

Preferred Qualifications

• Experience with legacy Microsoft technologies such as Classic ASP, VBScript, VB6/VB.NET, older .NET frameworks, large .NET monoliths, and SQL-heavy applications


• Exposure to legacy modernization, cloud‑ready/12‑factor architecture, Angular or modern front‑end development, and distributed onshore/nearshore/offshore teams


• Healthcare or regulated‑industry experience, including HIPAA, and familiarity with SAFe/Agile environments are preferred

The pay range is the lowest to highest compensation we reasonably in good faith believe we would pay at posting for this role. We may ultimately pay more or less than this range. Employee pay is based on factors like relevant education, qualifications, certifications, experience, skills, seniority, location, performance, union contract and business needs. This range may be modified in the future.

We offer comprehensive benefits including medical/dental/vision insurance, HSA, FSA, 401(k), and life, disability & ADD insurance to eligible employees. Salaried personnel receive paid time off. Hourly employees are not eligible for paid time off unless required by law. Hourly employees on a Service Contract Act project are eligible for paid sick leave.

Note: Pay is not considered compensation until it is earned, vested and determinable. The amount and availability of any compensation remains in Kforce's sole discretion unless and until paid and may be modified in its discretion consistent with the law.

This job is not eligible for bonuses, incentives or commissions.

Kforce is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status, or disability status.