AppSec Engineer & AVP: Build Secure API & CI/CD

iCapital; Salt Lake City (UT); On-site; USD 100,000 - 130,000; Full time

Benefits offered by this job

Retirement plan

Health insurance

Dental insurance

Vision insurance

Telemedicine

Mental health support

Parental leave

Unlimited PTO

Job summary

iCapital is seeking an hands-on Application Security Engineer to join a small, high-impact team in Salt Lake City. You will work with the Head of AppSec on secure design, API security, and developer enablement.

The role involves threat modeling, CI/CD security, SAST/SCA remediation, and building Python automation to scale AppSec workflows. Office-based with some remote flexibility, you will collaborate with engineers to improve security across REST and GraphQL APIs.

Qualifications

• Hands-on experience in secure design and threat modeling
• Experience with API security, SAST/SCA workflows
• Familiarity with OWASP Top 10 in practice
• API security assessment for REST and GraphQL
• Ability to build security automation in Python

Responsibilities

• Support threat modeling and design reviews across services
• Support shift-left security in CI/CD, provide developer guidance, remediation workflows
• Contribute to API security across the organization
• Write Python automation to scale AppSec capacity
• Remediate SAST and SCA findings with developers and reduce false positives

Skills

Hands-on AppSec

Threat modeling

API security

SAST/SCA

Python automation

Security automation

Web app security

Autonomy

DevSecOps

Tools

Python

Job description

iCapital is seeking an hands-on Application Security Engineer to join a small, high-impact team in Salt Lake City. You will work with the Head of AppSec on secure design, API security, and developer enablement.

The role involves threat modeling, CI/CD security, SAST/SCA remediation, and building Python automation to scale AppSec workflows. Office-based with some remote flexibility, you will collaborate with engineers to improve security across REST and GraphQL APIs.