Senior App Security Engineer: DevSecOps & Security Pipelines

ESRI; Vienna (VA); On-site; USD 94,000 - 158,000; Full time

Job summary

Esri is seeking an Application Security Engineer to help secure its intellectual property and sensitive data across applications and cloud services. You will design and operate security testing pipelines, perform code reviews, and mentor development teams in secure coding practices.

The role requires hands-on experience in DevSecOps, Kubernetes, and multiple languages, with a focus on reducing risk. US citizenship and ability to obtain a US security clearance are required.

Qualifications

• 5+ years of experience in application security, including manual and automated code reviews, manual penetration testing, dynamic application security testing, and false positive analysis of code, pen tests, and open-source findings.
• Demonstrated experience determining risk based on analysis/findings using a consistent risk management framework.
• Proven ability to develop automations/applications using Python, TypeScript, Java, or PowerShell.
• Experience creating and maintaining reusable GitHub Actions workflows with expertise in GitHub workflow management.
• Hands‑on experience in a DevSecOps environment built on Kubernetes with knowledge of Kubernetes security best practices.
• Ability to read and analyze code for security and design vulnerabilities.
• Solid understanding of web app security standards (HTTP, OAuth, OIDC, REST).
• Experience working with AWS and Azure cloud platforms.
• Willingness to learn new skills and enhance workflows using AI tools.
• US citizenship and willingness/ability to obtain a US Security Clearance.

Responsibilities

• Design, operate, and continuously improve application security testing capabilities and pipelines.
• Assess application risks and recommend mitigations.
• Perform application layer security reviews of code across multiple languages and frameworks.
• Assist with application layer penetration testing to identify potential issues.
• Provide application security guidance and mentorship to development teams as needed.

Skills

Python

TypeScript

Java

PowerShell

Kubernetes

Code analysis

Cloud security

Education

Bachelor's degree in computer science or related field

Tools

GitHub Actions

AWS

Azure

Job description

Esri is seeking an Application Security Engineer to help secure its intellectual property and sensitive data across applications and cloud services. You will design and operate security testing pipelines, perform code reviews, and mentor development teams in secure coding practices.

The role requires hands-on experience in DevSecOps, Kubernetes, and multiple languages, with a focus on reducing risk. US citizenship and ability to obtain a US security clearance are required.