Senior App Security Engineer: Threat Modeling & Secure SDLC

H&R Block, Inc.; Northern (KY); Hybrid; USD 140,000 - 180,000; Full time

Job summary

H&R Block, Inc. is seeking a Senior Application Security Engineer to ensure the security of products throughout their lifecycle. You will consult with security stakeholders and guide secure design and development, with emphasis on threat modelling and secure DevOps practices.

Responsibilities include threat modelling, code reviews, SAST/DAST, and automation to embed security in the CI/CD pipeline. You will mentor teams and promote security awareness across engineering and product functions.

Qualifications

• 5+ years of experience in an application security role.
• Experience leading architectural changes or cross-team efforts to mitigate security vulnerabilities.
• Familiarity with threat modelling methodologies and security standards.

Responsibilities

• Perform threat modelling and vulnerability assessments to identify risks in product design.
• Implement security tooling and automate SDLC security practices across pipelines.
• Conduct code reviews, SAST/DAST, and IaC scanning to ensure security controls are in place.
• Mentor product, engineering, and IT teams on security best practices.

Skills

Application security

Threat modelling

CI/CD security

Python

Security tooling

Code reviews

Education

Bachelor's degree in Computer Science or Cybersecurity

Tools

AWS

Azure

SAST/DAST tools

Terraform

Ansible

Job description

H&R Block, Inc. is seeking a Senior Application Security Engineer to ensure the security of products throughout their lifecycle. You will consult with security stakeholders and guide secure design and development, with emphasis on threat modelling and secure DevOps practices.

Responsibilities include threat modelling, code reviews, SAST/DAST, and automation to embed security in the CI/CD pipeline. You will mentor teams and promote security awareness across engineering and product functions.