Lead Application Security Engineer: Threat Modeling & Secure SDLC

Mach7 Technologies; Burlington, Northern (VT, KY); Hybrid; USD 120,000 - 160,000; Full time

Job summary

Mach7 Technologies seeks a Senior Security Engineer to lead application security across our product portfolio, embedding security into the full software development lifecycle. You will model the product attack surface, prioritize risks, and guide threat modeling, vulnerability management, and supply chain security.

You will read code, review architecture, and coach developers through secure reviews while integrating SAST/DAST/SCA into CI/CD pipelines and driving remediation of vulnerabilities

Qualifications

• 5+ years of experience in security engineering with a strong AppSec focus.
• Proficiency with threat modeling frameworks (STRIDE, PASTA, or similar).
• Knowledge of common AppSec tooling: Semgrep, Snyk, Burp Suite, OWASP ZAP, or equivalents.
• Deep understanding of web app and API security, including OWASP Top 10.
• Ability to read and reason about code in multiple languages; development background is a plus.
• Experience with software supply chain security—SBOM generation/analysis and SCA tooling.

Responsibilities

• Own and evolve the AppSec program across the SDLC for web, API, mobile, and shipped products.
• Build and maintain a living model of the product attack surface to drive prioritization.
• Conduct threat modeling and architecture security reviews for new features and releases.
• Perform manual and automated secure code reviews across languages (Python, Go, TS, C/C++).
• Integrate SAST, DAST, and SCA tooling within CI/CD pipelines.
• Triage and drive remediation of vulnerabilities from scanning, bug bounty, and pen tests.
• Develop and maintain security standards and guardrails across product types.
• Lead security training and developer education initiatives.

Skills

Threat modeling

AppSec tooling

Code review

Security architecture

SBOM

Tools

Semgrep

Snyk

Burp Suite

OWASP ZAP

SAST tooling

DAST tooling

SCA tooling

Job description

Mach7 Technologies seeks a Senior Security Engineer to lead application security across our product portfolio, embedding security into the full software development lifecycle. You will model the product attack surface, prioritize risks, and guide threat modeling, vulnerability management, and supply chain security.

You will read code, review architecture, and coach developers through secure reviews while integrating SAST/DAST/SCA into CI/CD pipelines and driving remediation of vulnerabilities