Senior App Sec Engineer: Lead Secure SDLC (Remote)

platacard; United States; Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Relocation with visa support

Flexible work office or remote

Healthcare coverage

Education budget for training

Wellness budget

20 days annual leave

Job summary

platacard is seeking a Senior Application Security Engineer to embed protective controls across the full SDLC. You will bridge development and security, design safeguards, and raise secure coding standards in a technology-driven environment.

You will collaborate with engineering and operations, perform threat modeling and architecture reviews, and lead proactive remediation for web and mobile apps while enabling shift-left security practices across teams.

Qualifications

• Hands-on with web and mobile programming languages.
• Strong knowledge of OWASP Top 10, threat modeling techniques, and security testing frameworks.
• Experience with security tooling: ZAP, Dependency-Track, Burp Suite.
• Certifications like OSCP/OSWE/GWAPT/GCPN are a plus; SaaS/cloud background helpful.

Responsibilities

• Promote secure coding practices and participate in code reviews across SDLC.
• Perform architecture reviews and threat modeling to surface risks early.
• Deploy and maintain SAST/DAST/IAST/RASP and SCA in CI/CD pipelines.
• Lead security incident response, investigation, containment, and hardening.
• Drive shift-left security, enable continuous testing and rapid remediation.
• Conduct workshops on OWASP, ASVS, and secure design standards.

Skills

Web & mobile programming

Microservices

OWASP Top 10

Threat modeling

Security testing frameworks

Tools

ZAP

Dependency-Track

Burp Suite

Job description

platacard is seeking a Senior Application Security Engineer to embed protective controls across the full SDLC. You will bridge development and security, design safeguards, and raise secure coding standards in a technology-driven environment.

You will collaborate with engineering and operations, perform threat modeling and architecture reviews, and lead proactive remediation for web and mobile apps while enabling shift-left security practices across teams.