AppSec Engineer: Secure SDLC & Patch Vulnerabilities

Yum! Brands; United States; Remote; USD 110,000 - 170,000; Full time

Job summary

Yum! Brands is seeking an Application Security Engineer to partner with US teams, guiding security as a subject matter expert on applications.

You will collaborate with third-party engineers and product owners to identify, prioritize, and remediate vulnerabilities in web and mobile apps, while maintaining SAST/DAST/SCA and container security profiles. The role emphasizes SSDLC practices, secure coding, and proactive security campaigns.

Qualifications

• Bachelor's degree required; four+ years in cybersecurity, software engineering, or app development.
• Experience evaluating vulnerabilities for exploitability and business risk.
• Familiarity with SSDLC practices and secure coding standards.
• Knowledge of CI/CD pipelines and Git-based development workflows.
• Knowledge of SAST/DAST/SCA testing methods and secrets detection.
• Understanding of OWASP Top 10 and modern authentication tech.

Responsibilities

• Provide security guidance as a SME on applications for US teams.
• Identify and remediate vulnerabilities with third-party engineers and product owners.
• Review findings and communicate remediation plans to engineering teams.
• Maintain application security scan profiles across SAST/DAST/SCA, container security, IaC.
• Integrate security into the SDLC and automate tests.
• Lead awareness campaigns for secure software development.
• Monitor vulnerabilities in dependencies and coordinate incident root-cause analyses.

Skills

SSDLC

OWASP Top 10

CI/CD pipelines

Git workflows

Vulnerability assessment

Secure coding

OAuth 2.0 / OIDC / SAML / JWT

Container security

Education

Bachelor's degree

Tools

Docker

Kubernetes

Terraform

CloudFormation

Job description

Yum! Brands is seeking an Application Security Engineer to partner with US teams, guiding security as a subject matter expert on applications.

You will collaborate with third-party engineers and product owners to identify, prioritize, and remediate vulnerabilities in web and mobile apps, while maintaining SAST/DAST/SCA and container security profiles. The role emphasizes SSDLC practices, secure coding, and proactive security campaigns.