Lead Application Security Engineer — Hybrid/Remote

Blue Cross Blue Shield of Nebraska; United States; Hybrid; USD 140,000 - 180,000; Full time

Job summary

Blue Cross and Blue Shield of Nebraska is seeking a Senior Application Security Engineer to lead and own our application security capabilities. This role focuses on implementing secure software development practices, with emphasis on SAST/DAST, AI-related code risk, and risk-based vulnerability management.

You will partner with engineering, architecture, and risk teams to deliver practical, scalable security solutions across the enterprise.

Qualifications

• Bachelor's degree in Computer Science, Information Security, or related field (or equivalent experience).
• 6 years of experience in application security, secure software development, or DevSecOps.
• Hands-on experience with SAST, DAST, and dependency scanning tools, including tuning and operational ownership.
• Strong understanding of application vulnerability classes (OWASP Top 10, APIs, authentication, authorization).
• Experience integrating security into CI/CD pipelines and development workflows.
• Proven ability to assess risk, prioritize remediation, and clearly communicate decisions.
• Comfort working independently, taking ownership, and driving outcomes with minimal oversight.
• Strong communication skills with the ability to work effectively with developers, architects, and leadership.

Responsibilities

• Own and operate application security tooling, including SAST, DAST, and software composition analysis.
• Embed application security into CI/CD pipelines and development workflows to support shift-left security.
• Perform secure code reviews and validate vulnerabilities for exploitability, impact, and remediation feasibility.
• Define and maintain secure coding standards, guidance, and reusable security patterns for development teams.
• Establish guardrails and review expectations for AI-assisted and AI-generated code, reducing unowned and unmanaged application risk.
• Partner with development teams to triage findings, reduce false positives, and drive effective remediation.
• Apply risk-based decision making aligned to organizational risk appetite and compliance frameworks (NIST, HIPAA, SOC 2).
• Support application threat modeling and identification of architectural security gaps.
• Collaborate with cloud, platform, and identity teams to ensure applications integrate securely with enterprise services.
• Contribute to audit readiness, evidence collection, and regulatory support related to application security controls.
• Reduce single-points-of-failure by documenting processes, mentoring others, and improving program resiliency.

Skills

Application security

CI/CD security

Risk assessment

Communication

Independent work

Education

Bachelor's degree in CS or related field

Tools

SAST tools

DAST tools

Dependency scanning

Azure PaaS

Job description

Blue Cross and Blue Shield of Nebraska is seeking a Senior Application Security Engineer to lead and own our application security capabilities. This role focuses on implementing secure software development practices, with emphasis on SAST/DAST, AI-related code risk, and risk-based vulnerability management.

You will partner with engineering, architecture, and risk teams to deliver practical, scalable security solutions across the enterprise.