AppSec & Vulnerability Engineer — Secure DevOps

Performance Food Group (New); United States; Remote; USD 110,000 - 140,000; Full time

Job summary

Performance Food Group is seeking an Application Security & Vulnerability Engineer to lead the secure development lifecycle across the organization. The role partners with Infrastructure and App Dev teams to implement scanning, remediation, and reporting within the CI/CD pipeline.

The candidate will support incident response, threat intelligence, and compliance initiatives while advancing secure coding practices and governance across the software stack.

Qualifications

• 3–5 years in information security or application security.
• Experience with SAST/DAST, SCA, and dependency scanning.
• Understanding of secure SDLC and CI/CD integration.
• Ability to communicate risk to technical and business teams.
• Familiarity with OWASP Top 10 and cloud security concepts.

Responsibilities

• Lead the Application Security program with secure coding practices.
• Conduct security assessments using SAST/DAST and SCA.
• Integrate security controls into CI/CD pipelines.
• Advise dev teams on secure coding and remediation timelines.
• Track vulnerability trends and report to IT leadership.
• Support incident response and threat intelligence activities.
• Promote secure development across the SDLC.

Skills

SAST/DAST

SCA

IaC

CI/CD security

Vulnerability management

Threat intelligence

Secure SDLC

Education

Associate's degree in IT/CS/Cybersecurity

Tools

Nessus

Code Scanning Tools

Job description

Performance Food Group is seeking an Application Security & Vulnerability Engineer to lead the secure development lifecycle across the organization. The role partners with Infrastructure and App Dev teams to implement scanning, remediation, and reporting within the CI/CD pipeline.

The candidate will support incident response, threat intelligence, and compliance initiatives while advancing secure coding practices and governance across the software stack.