Information Security Application Engineer | Full-TIme Contract | Remote

LHH; United States; Remote; USD 103,000 - 117,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401K plan

Job summary

LHH is seeking an Information Security Application Engineer for a remote contract-to-fulltime opportunity in the United States. You will embed security across the SDLC for eCommerce platforms, APIs, mobile apps, and cloud services, bridging software engineering and cybersecurity with DevSecOps focus.

You will conduct threat modeling, code reviews, and security testing while guiding remediation with engineering teams, applying OWASP and CWE principles across environments.

Qualifications

• 4+ years of combined experience in software development, application security, security engineering, or related discipline.
• Strong code-level literacy and ability to review application code with developers.
• Solid understanding of web, API, native mobile, microservices, and cloud-native application security.
• Hands-on DevSecOps experience in security controls within CI/CD environments.

Responsibilities

• Embed application security throughout the SDLC from architecture to production support.
• Conduct threat modeling, architecture/design reviews, data-flow analysis and risk assessments.
• Review source code, PRs, configurations, and IaC for security issues.
• Partner with developers to identify vulnerabilities and provide remediation guidance.
• Apply OWASP principles across web, API, mobile, and cloud-native environments.
• Integrate and optimize SAST, DAST, SCA, secrets scanning, container, and IaC scanning in CI/CD.
• Triage findings, assess impact, reduce false positives, and work with teams to remediate.
• Assess third-party libraries, SDKs, APIs, SaaS, and payment components for risk.

Skills

Code-level literacy

DevSecOps

Threat modeling

CI/CD security

OWASP Top 10

SAST/DAST

REST/GraphQL APIs

Cloud security

Collaboration with developers

Tools

Git

CI/CD tooling

IaC scanning

SAST tooling

DAST tooling

Job description

Information Security Application Engineer | Full Time - Contract | Remote

Compensation: $75 - $85/hr

We’re partnering with an established organization seeking an experienced Information Security Application Engineer for a contract opportunity. This is a highly hands-on Application Security / DevSecOps role focused on embedding security throughout the software development lifecycle across customer-facing eCommerce platforms, native mobile applications, APIs, microservices, and cloud services.

This is an excellent opportunity for someone who can bridge the gap between software engineering and cybersecurity, working directly with developers, architects, product teams, QA, DevOps, and platform engineering to identify risk early and translate security requirements into practical engineering solutions.

What You'll Be Doing

• Embed application security throughout the SDLC, from architecture and design through development, testing, deployment, and production support.
• Conduct threat modeling, architecture/design reviews, data-flow analysis, trust-boundary reviews, abuse-case analysis, and security risk assessments.
• Review source code, pull requests, application configurations, and Infrastructure as Code (IaC) for security vulnerabilities.
• Partner directly with developers to identify vulnerabilities and recommend practical, code-level remediation.
• Apply OWASP Top 10, OWASP ASVS, OWASP API Security Top 10, OWASP MASVS, and CWE principles across web, API, mobile, and cloud-native environments.
• Integrate and optimize SAST, DAST, Software Composition Analysis (SCA), secrets scanning, container scanning, IaC scanning, API testing, and mobile application security testing within CI/CD pipelines.
• Evaluate areas including authentication, authorization, session management, cryptography, secrets management, dependency risk, API security, logging, data protection, and secure communications.
• Triage security findings, assess exploitability and business impact, reduce false positives, and work with engineering teams through remediation.
• Assess third-party libraries, SDKs, APIs, SaaS integrations, and payment-related components for security risk.

What We're Looking For

• 4+ years of combined experience in software development, application security, security engineering, secure architecture, or a closely related technical discipline.
• Strong code-level literacy and the ability to review and discuss application code with developers.
• Strong understanding of web, API, native mobile, microservices, and cloud-native application security.
• Hands-on DevSecOps experience implementing security controls within CI/CD environments.
• Experience with development workflows including Git, pull requests, code review, build pipelines, automated testing, artifact repositories, and issue tracking.
• Familiarity with REST/GraphQL APIs, containers, microservices, API gateways, identity providers, and secrets-management platforms.
• Ability to translate complex security risks into actionable engineering guidance without becoming a bottleneck to delivery.
• A collaborative, pragmatic approach and the ability to build credibility with software engineers and architects.

Highly Valued Experience

Experience securing any of the following would be especially attractive:

• Native iOS / Android applications
• Payment-related systems
• Privacy-sensitive applications
• Regulated environments
• Cloud-native and microservices architectures

Security certifications such as CSSLP, GWAPT, GWEB, GSSP, CISSP, or CCSP are beneficial but not required.

Opportunity Details

Interested?

#ApplicationSecurity #AppSec #DevSecOps #CyberSecurity #InformationSecurity #ProductSecurity #CloudSecurity #OWASP #APISecurity #MobileSecurity #SAST #DAST #SoftwareSecurity #ContractJobs

"Benefit offerings include medical, dental, vision, life insurance, short-term disability, additional voluntary benefits,

EAP program, commuter benefits, and 401K plan. Our program provides employees the flexibility to choose the type

of coverage that meets their individual needs. Available paid leave may include Paid Sick Leave, where required by

law; any other paid leave required by Federal, State, or local law; and Holiday pay upon meeting eligibility criteria."

"Equal Opportunity Employer/Veterans/Disabled

To read our Candidate Privacy Information Statement, which explains how we will use your information, please navigate to https://www.lhh.com/us/en/candidate-privacy

The Company will consider qualified applicants with arrest and conviction records in accordance with federal, state, and local laws and/or security clearance requirements, including, as applicable:

• The California Fair Chance Act
• Los Angeles City Fair Chance Ordinance
• Los Angeles County Fair Chance Ordinance for Employers