Remote AppSec Engineer: SDLC & DevSecOps

LHH; United States; Remote; USD 103,000 - 117,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401K plan

Job summary

LHH is seeking an Information Security Application Engineer for a remote contract-to-fulltime opportunity in the United States. You will embed security across the SDLC for eCommerce platforms, APIs, mobile apps, and cloud services, bridging software engineering and cybersecurity with DevSecOps focus.

You will conduct threat modeling, code reviews, and security testing while guiding remediation with engineering teams, applying OWASP and CWE principles across environments.

Qualifications

• 4+ years of combined experience in software development, application security, security engineering, or related discipline.
• Strong code-level literacy and ability to review application code with developers.
• Solid understanding of web, API, native mobile, microservices, and cloud-native application security.
• Hands-on DevSecOps experience in security controls within CI/CD environments.

Responsibilities

• Embed application security throughout the SDLC from architecture to production support.
• Conduct threat modeling, architecture/design reviews, data-flow analysis and risk assessments.
• Review source code, PRs, configurations, and IaC for security issues.
• Partner with developers to identify vulnerabilities and provide remediation guidance.
• Apply OWASP principles across web, API, mobile, and cloud-native environments.
• Integrate and optimize SAST, DAST, SCA, secrets scanning, container, and IaC scanning in CI/CD.
• Triage findings, assess impact, reduce false positives, and work with teams to remediate.
• Assess third-party libraries, SDKs, APIs, SaaS, and payment components for risk.

Skills

Code-level literacy

DevSecOps

Threat modeling

CI/CD security

OWASP Top 10

SAST/DAST

REST/GraphQL APIs

Cloud security

Collaboration with developers

Tools

Git

CI/CD tooling

IaC scanning

SAST tooling

DAST tooling

Job description

LHH is seeking an Information Security Application Engineer for a remote contract-to-fulltime opportunity in the United States. You will embed security across the SDLC for eCommerce platforms, APIs, mobile apps, and cloud services, bridging software engineering and cybersecurity with DevSecOps focus.

You will conduct threat modeling, code reviews, and security testing while guiding remediation with engineering teams, applying OWASP and CWE principles across environments.