Senior Application Security Engineer

Cybersecurity Jobs; Omaha (NE); Remote; USD 140,000 - 180,000; Full time

Job summary

Blue Cross and Blue Shield of Nebraska (BCBSNE) is seeking a Senior Application Security Engineer to lead enterprise-wide security capabilities and champion secure software development practices. The role emphasizes static/dynamic analysis, DevSecOps integration, AI-related code risk, and risk-based vulnerability management.

You will partner with engineering, architecture, and risk teams to deliver practical, scalable security solutions while mentoring others and supporting audit readiness and

Qualifications

• Bachelor’s degree in Computer Science, Information Security, or related field (or equivalent experience).
• 6 years of experience in application security, secure software development, or DevSecOps.
• Hands-on experience with SAST, DAST, and dependency scanning tools, including tuning and operational ownership.
• Strong understanding of OWASP Top 10, APIs, authentication, and authorization.
• Experience integrating security into CI/CD pipelines and development workflows.

Responsibilities

• Own and operate application security tooling (SAST, DAST, software composition analysis).
• Embed application security into CI/CD pipelines and development workflows to enable shift-left security.
• Conduct secure code reviews and validate vulnerabilities for exploitability, impact, and remediation feasibility.
• Define and maintain secure coding standards, guidance, and reusable security patterns.
• Establish guardrails and review AI-assisted or AI-generated code to reduce risk.
• Triage findings with development teams to reduce false positives and drive remediation.
• Apply risk-based decision making aligned to risk appetite and compliance (NIST, HIPAA, SOC 2).
• Support application threat modeling and identify architectural security gaps.
• Collaborate with cloud, platform, and identity teams to secure application integration.
• Contribute to audit readiness and regulatory support for application security controls.
• Document processes, mentor others, and improve program resiliency.

Skills

SAST/DAST tooling

CI/CD integration

Vulnerability risk assessment

Communication with stakeholders

Independent ownership

AI risk awareness

Experience in App Security (6+ yrs)

Education

Bachelor’s degree in Computer Science, Information Security, or related field

CSSLP / GWAPT / CISSP (preferred)

Job description

About the Role

Blue Cross and Blue Shield of Nebraska (BCBSNE) is mission-driven and focused on supporting the health and well-being of members and the communities it serves. As a Senior Application Security Engineer, you will act as a technical leader and owner for application security capabilities across the organization. This role implements and operates secure software development practices enterprise-wide, with an emphasis on static and dynamic code analysis, DevSecOps integration, AI-related code risk, and risk-based vulnerability management.

You will work independently, take ownership of outcomes, and partner with engineering, architecture, and risk teams to deliver security solutions that are practical and scalable.

Work Location and Travel

The ideal candidate lives within driving distance of the Omaha, Nebraska office. The position offers remote flexibility with 1 day per week in the office.

If you live in an approved state (Florida, Iowa, Kansas, Minnesota, Missouri, Nebraska, North Dakota, and Texas), you may travel to the headquarters based on business needs.

What You’ll Do

• Own and operate application security tooling, including SAST, DAST, and software composition analysis, ensuring tools are tuned, effective, and aligned to business risk.
• Embed application security into CI/CD pipelines and development workflows to enable shift-left security while minimizing developer friction.
• Conduct secure code reviews and validate vulnerabilities for exploitability, impact, and remediation feasibility.
• Define and maintain secure coding standards, guidance, and reusable security patterns for development teams.
• Establish guardrails and review expectations for AI-assisted and AI-generated code to reduce unowned and unmanaged application risk.
• Partner with development teams to triage findings, reduce false positives, and drive effective remediation.
• Apply risk-based decision making aligned to organizational risk appetite and compliance frameworks including NIST, HIPAA, and SOC 2.
• Support application threat modeling and identify architectural security gaps.
• Collaborate with cloud, platform, and identity teams so applications securely integrate with enterprise services.
• Contribute to audit readiness, evidence collection, and regulatory support related to application security controls.
• Reduce single points of failure by documenting processes, mentoring others, and improving program resiliency.

Required Qualifications

• Bachelor’s degree in Computer Science, Information Security, or a related field (or equivalent experience).
• 6 years of experience in application security, secure software development, or DevSecOps.
• Hands-on experience with SAST, DAST, and dependency scanning tools, including tuning and operational ownership.
• Strong understanding of application vulnerability classes including OWASP Top 10, APIs, authentication, and authorization.
• Experience integrating security into CI/CD pipelines and development workflows.
• Proven ability to assess risk, prioritize remediation, and clearly communicate decisions.
• Comfort working independently, taking ownership, and driving outcomes with minimal oversight.
• Strong communication skills, with the ability to work effectively with developers, architects, and leadership.

Preferred Qualifications

• Experience in healthcare or other regulated industries.
• Familiarity with Azure PaaS and cloud-native application architectures.
• Exposure to AI-assisted development risks, automation, or modern code-generation tools.
• Threat modeling experience and participation in security design reviews.
• Scripting or automation experience (Python, PowerShell, Bash).
• Relevant certifications (CSSLP, GWAPT, CISSP, or equivalent).
• An equivalent combination of education and experience may be substituted for this requirement.

Additional Job Requirements

• Ability to meet or exceed departmental attendance and timeliness requirements.
• On-call work may be required based on business needs and role assignment.
• Ability to work well in a team environment and maintain positive relationships with staff, departments, and customers.

To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed represent the knowledge, skill, and ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform essential functions. Other duties may be assigned.

What We Offer

Learn more about BCBSNE’s comprehensive Total Rewards package at NebraskaBlue.com/Careers.

BCBSNE believes diversity of experience, perspective, and background leads to a better workplace and better products for customers and members.

Security Reminder for Applicants

BCBSNE only accepts job applications submitted through its official careers website. Genuine correspondence will come from an email address ending with @nebraskablue.com. BCBSNE does not ask for sensitive personal information such as banking details, and interviews take place before any job offer is made.

EEO Statement

BCBSNE is an Equal Opportunity / Aff…? Qualified individuals with a disability or a disabled veteran have the right to request an accommodation if unable or limited in their ability to use or access the career center due to their disability. To request an accommodation, contact a Human Resources Representative at BCBSNE.