AppSec Engineer - AI/SDLC Security & Automation

Nelnet, Inc.; Northern (KY); Hybrid; USD 90,000 - 125,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

HSA / FSA

401K with company match

Student loan repayment

Life insurance & AD&D

EAP

Stock purchase program

Tuition reimbursement

Performance-based incentive pay

Short- and long-term disability

Wellness program

Job summary

Nelnet, Inc. is seeking an Application Security Engineer to perform manual source code reviews and automated security testing, shaping secure SDLC processes and CI/CD integration.

You will collaborate with product, engineering, and cloud teams to safeguard apps and AI features, delivering clear vulnerability reports to leadership. Required 2–4 years in application security, familiarity with OWASP Top 10, and strong scripting skills.

Qualifications

• 2–4 years of hands-on application security experience.
• Experience integrating security tooling and automated checks into CI/CD pipelines.
• Familiarity with OWASP Top 10 and web testing methodologies.
• Ability to assess and communicate risks to management and engineering staff.

Responsibilities

• Manual source code reviews across major languages.
• SAST/DAST scanning and security tooling integration into pipelines.
• Expand the Security Champions program and automate source code review processes.
• Collaborate with product teams to enforce secure SDLC practices.
• Produce detailed vulnerability reports for business stakeholders.
• Mentor junior engineers on secure coding practices.

Skills

Manual code review

Threat modeling STRIDE

CI/CD integration

AI/LLM security

Scripting (Python, Bash, Node)

Web/API security concepts

Communication skills

Tools

SAST

SCA

DAST

Web pentesting

Container scanners

Secrets-detection tools

AI-security scanning platforms

Job description

Nelnet, Inc. is seeking an Application Security Engineer to perform manual source code reviews and automated security testing, shaping secure SDLC processes and CI/CD integration.

You will collaborate with product, engineering, and cloud teams to safeguard apps and AI features, delivering clear vulnerability reports to leadership. Required 2–4 years in application security, familiarity with OWASP Top 10, and strong scripting skills.