Remote Application Security & Vulnerability Engineer

Core-Mark

Northern (KY)

Remote

USD 110,000 - 150,000

Full time

10 days ago

Application generator

Turn this role into an interview — a resume and cover letter built around what this employer wants.

Get past ATS filters

Job summary

Performance Food Group is seeking an Application Security & Vulnerability Engineer to lead secure coding practices and mature the application security program across the CI/CD lifecycle. You will partner with Infrastructure and Development teams to implement scanning, remediation, reporting, and governance across the software stack.

The role supports incident response, threat intelligence, and compliance initiatives in a fully remote setting.

Qualifications

Associate's degree in IT, CS, Cybersecurity or related field or equivalent 3-5 years direct application security experience.
3-5 years of related work experience in information security or application security.
Experience with SAST/DAST, SCA, and dependency scanning.
Understanding of secure SDLC and how to integrate security into CI/CD pipelines.
Familiarity with OWASP Top 10, identity and access management, and common attack techniques.

Responsibilities

Build and mature PFG's Application Security program and secure coding practices.
Conduct application security assessments using code scanning (SAST/DAST), dependency/composition analysis (SCA), and security testing tools; coordinate remediation through closure with application owners.
Evaluate applications and CI/CD pipelines to integrate security controls, automate vulnerability detection, and improve remediation processes and timelines.
Advise development teams on secure coding practices and help embed security requirements earlier in the development lifecycle.
Develop developer security training content and drive adoption of secure development practices across applicable functional areas.
Track and report on application vulnerability trends, remediation SLAs, and program maturity to IT leadership and application owners.
Identify and evaluate security risks within application development and deployment processes, helping promote secure access controls and governance practices.