Remote Application Security & Vulnerability Engineer

Performance Food Group; United States; Remote; USD 100,000 - 110,000; Full time

Benefits offered by this job

Day 1 health benefits

Employee stock purchase plan

401K employer matching

Education assistance

Paid time off

Job summary

Performance Food Group is seeking an Application Security & Vulnerability Engineer to lead the secure development and vulnerability management efforts across the organization. You will partner with Infrastructure and Development teams to implement scanning, remediation, reporting, and secure development practices throughout the SDLC.

This is a fully remote opportunity! You will support incident response, threat intelligence, and compliance activities as part of the broader Information Security

Qualifications

• Associate's degree in IT, CS, Cybersecurity or related field, or equivalent 3–5 years of direct application security experience.
• 3–5 years of related work experience in information security or application security.
• Familiarity with IaC concepts and secure SDLC integration into CI/CD pipelines.
• Knowledge of OWASP Top 10 and common web app vulnerabilities.

Responsibilities

• Build and mature the Application Security program and secure coding practices across development teams.
• Conduct security assessments using SAST/DAST, SCA, and dependency scanning; coordinate remediation.
• Integrate security controls into CI/CD pipelines and automate vulnerability detection.
• Develop developer security training content and promote secure development practices.
• Track vulnerability trends and remediation SLAs; report to IT leadership.

Skills

Application security

Secure coding practices

Communication skills

Education

Associate's degree in IT/CS/Cybersecurity

Tools

SAST/DAST

SCA

IaC security tooling

Job description

Performance Food Group is seeking an Application Security & Vulnerability Engineer to lead the secure development and vulnerability management efforts across the organization. You will partner with Infrastructure and Development teams to implement scanning, remediation, reporting, and secure development practices throughout the SDLC.

This is a fully remote opportunity! You will support incident response, threat intelligence, and compliance activities as part of the broader Information Security