AppSec Engineer - Remote CI/CD Automation & Threat Modeling

ProducePay; United States; On-site; USD 131,250 - 235,156; Full time

Benefits offered by this job

Remote first culture

Flexible PTO

12 annual holidays

10 days sick leave

4 weeks bereavement leave

2 volunteer days off

2 professional development days off

12 weeks paid parental leave

75–95% employer cost coverage for medical, dental, and vision benefits

Job summary

ProducePay is searching for a hands-on Application Security Engineer to join their Information Security team. This position entails owning the vulnerability management lifecycle, integrating security automation within the CI/CD pipeline, and supporting engineering squads to secure applications effectively.

The ideal candidate should have 3–5 years of experience in Application Security and be proficient with tools like Snyk and Checkmarx. The role supports a remote-first culture, providing flexibility and comprehensive benefits for employees across the United States.

Qualifications

• 3–5 years of dedicated Application Security experience in a SaaS or cloud-native environment.
• Hands-on proficiency with SAST, DAST, or SCA tooling.
• Experience with CI/CD pipelines like GitHub Actions or Jenkins.
• Ability to communicate technical risk effectively.
• Exposure to threat modeling frameworks like STRIDE or PASTA.

Responsibilities

• Own and drive remediation of findings from security tools.
• Maintain and optimise security tooling integrations in CI/CD.
• Run a Security Champions program to embed security knowledge.
• Act as subject-matter expert during security incidents.
• Introduce security touchpoints earlier in the SDLC.

Skills

Application Security expertise

SAST tooling

DAST tooling

SCA tooling

CI/CD knowledge

API security patterns

Container security

Communication of technical risks

Tools

Snyk

Checkmarx

Semgrep

Wiz

Docker

Kubernetes

Job description

ProducePay is searching for a hands-on Application Security Engineer to join their Information Security team. This position entails owning the vulnerability management lifecycle, integrating security automation within the CI/CD pipeline, and supporting engineering squads to secure applications effectively.

The ideal candidate should have 3–5 years of experience in Application Security and be proficient with tools like Snyk and Checkmarx. The role supports a remote-first culture, providing flexibility and comprehensive benefits for employees across the United States.