Senior Application Security Engineer

Synechron; San Francisco (CA); On-site; USD 160,000 - 230,000; Full time

Benefits offered by this job

Competitive compensation

Global offices

Paid annual leave

Maternity & paternity leave

Insurance plan

Retirement savings

Education policy

Commuter benefits

Training opportunities

Udemy for Business

Mentoring & development

Global projects

Job summary

Synechron is seeking an experienced Application Security Engineer to integrate security across the software development lifecycle. You will secure custom apps, APIs, dependencies, containerized workloads, and CI/CD pipelines while partnering with development, platform, and risk teams.

The role requires strong scripting and automation experience in Python, PowerShell, Bash, or similar, plus hands-on vulnerability management and secure design expertise.

Qualifications

• Hands-on experience developing, reviewing, testing, and remediating application code in modern software environments.
• Experience identifying and mitigating vulnerabilities in applications, APIs, container images, frameworks, runtimes, and software supply chains.
• Strong understanding of secure software design, secure coding practices, threat modeling, and common application security risks.

Responsibilities

• Inventory and baseline in-scope applications, repositories, dependencies, container images, delivery pipelines, security-tool coverage, and end-of-life frameworks and runtimes; identify unmanaged or unscanned assets.
• Partner with development teams to identify, prioritize, and remediate vulnerabilities in code, APIs, dependencies, container images, and application configurations.
• Perform secure code reviews, architecture and design reviews, and application security assessments throughout the software development lifecycle.
• Write, review, test, and submit application-code and pipeline-configuration changes required to resolve security issues.
• Define, implement, and maintain risk-based security gates, approval criteria, automated controls, and controlled bypass processes across source-control and CI/CD workflows.
• Configure and tune application security tooling to improve coverage, accuracy, maintainability, developer usability, and false-positive rates; recommend whether tools should be retained or retired.
• Establish secure development standards, remediation SLAs, finding-routing rules, and an application-security exception register with compensating controls, owners, expiration dates, and escalation paths.
• Develop automation for repository and pipeline coverage monitoring, finding intake, triage, ownership assignment, overdue remediation, failed gates, expired exceptions, reporting, and escalation.
• Support container and Kubernetes security through dependency and base-image currency practices, image governance, workload controls, and policy-as-code enforcement.
• Define, track, and report application security KPIs, including scanner coverage, remediation performance, gate effectiveness, backlog and exception aging, and end-of-life technology risk; create runbooks, operating documentation, training, and knowledge transfer materials.

Skills

Secure coding practices

DevSecOps

Threat modeling

SAST

Container security

Python scripting

CI/CD security

Communication skills

Tools

Docker

Kubernetes

Job description

At Synechron, we believe in the power of digital to transform businesses for the better. Our global consulting firm combines creativity and innovative technology to deliver industry-leading digital solutions. Synechron’s progressive technologies and optimization strategies span end-to-end Artificial Intelligence, Consulting, Digital, Cloud & DevOps, Data, and Software Engineering, servicing an array of noteworthy financial services and technology firms. Through research and development initiatives in our FinLabs we develop solutions for modernization, from Artificial Intelligence and Blockchain to Data Science models, Digital Underwriting, mobile-first applications and more. Over the last 20+ years, our company has been honored with multiple employer awards, recognizing our commitment to our talented teams. With top clients to boast about, Synechron has a global workforce of 17,000, and has 58 offices in 22 countries within key global markets.

The Application Security Engineer is a hands-on software security professional responsible for integrating security throughout the software development lifecycle. The role focuses on securing custom applications, APIs, dependencies, containerized workloads, and CI/CD pipelines while partnering with development, platform, cybersecurity, and risk teams. The engineer identifies, prioritizes, and remediates application-layer risks, implements scalable controls, and helps establish a durable application security operating capability that can be transferred to permanent staff.

Requires 10-15 years of experience for mid-level candidates A strong combination of software engineering, application security, automation, DevSecOps, and security-program execution is required. Experience in regulated, high-availability, or business-critical environments is highly desirable.

Required Experience

• Hands-on experience developing, reviewing, testing, and remediating application code in modern software environments.
• Experience identifying and mitigating vulnerabilities in applications, APIs, open-source dependencies, container images, frameworks, runtimes, and software supply chains.
• Strong understanding of secure software design, secure coding practices, threat modeling, and common application security risks.
• Experience embedding security controls and approval criteria into source-control, pull-request, build, test, release, and deployment workflows.
• Practical experience with SAST, software composition analysis, secrets detection, dependency management, container scanning, and vulnerability-management platforms.
• Experience validating findings, assessing exploitability and business impact, reducing false positives, and defining risk-based remediation SLAs.
• Experience securing containerized and cloud-native applications, including Docker, Kubernetes, registries, base images, and policy-as-code controls.
• Strong scripting and automation experience using Python, PowerShell, Bash, or a comparable language.
• Experience operating vulnerability remediation, exception and risk-acceptance processes, including compensating controls, ownership, expiration, and escalation.
• Strong communication, problem-solving, and cross-functional leadership skills, with the ability to take ownership from discovery and baseline through implementation, stabilization, documentation, and knowledge transfer.

Responsibilities

• Inventory and baseline in-scope applications, repositories, dependencies, container images, delivery pipelines, security-tool coverage, and end-of-life frameworks and runtimes; identify unmanaged or unscanned assets.
• Partner with development teams to identify, prioritize, and remediate vulnerabilities in code, APIs, dependencies, container images, and application configurations.
• Perform secure code reviews, architecture and design reviews, and application security assessments throughout the software development lifecycle.
• Write, review, test, and submit application-code and pipeline-configuration changes required to resolve security issues.
• Define, implement, and maintain risk-based security gates, approval criteria, automated controls, and controlled bypass processes across source-control and CI/CD workflows.
• Configure and tune application security tooling to improve coverage, accuracy, maintainability, developer usability, and false-positive rates; recommend whether tools should be retained or retired.
• Establish secure development standards, remediation SLAs, finding-routing rules, and an application-security exception register with compensating controls, owners, expiration dates, and escalation paths.
• Develop automation for repository and pipeline coverage monitoring, finding intake, triage, ownership assignment, overdue remediation, failed gates, expired exceptions, reporting, and escalation.
• Support container and Kubernetes security through dependency and base-image currency practices, image governance, workload controls, and policy-as-code enforcement.
• Define, track, and report application security KPIs, including scanner coverage, remediation performance, gate effectiveness, backlog and exception aging, and end-of-life technology risk; create runbooks, operating documentation, training, and knowledge transfer materials.

We offer:

• A highly competitive compensation and benefits package.
• A multinational organization with 58 offices in 21 countries and the possibility to work abroad.
• 10 days of paid annual leave (plus sick leave and national holidays).
• Maternity & paternity leave plans.
• A comprehensive insurance plan including medical, dental, vision, life insurance, and long-/short-term disability (plans vary by region).
• Retirement savings plans.
• A higher education certification policy.
• Commuter benefits (varies by region).
• Extensive training opportunities, focused on skills, substantive knowledge, and personal development.
• On-demand Udemy for Business for all Synechron employees with free access to more than 5000 curated courses.
• Coaching opportunities with experienced colleagues from our Financial Innovation Labs (FinLabs) and Center of Excellences (CoE) groups.
• Cutting edge projects at the world’s leading tier-one banks, financial institutions and insurance firms.
• A flat and approachable organization.
• A truly diverse, fun-loving, and global work culture.

SYNECHRON’S DIVERSITY & INCLUSION STATEMENT

Diversity & Inclusion are fundamental to our culture, and Synechron is proud to be an equal opportunity workplace and is an affirmative action employer. Our Diversity, Equity, and Inclusion (DEI) initiative ‘Same Difference’ is committed to fostering an inclusive culture – promoting equality, diversity and an environment that is respectful to all. We strongly believe that a diverse workforce helps build stronger, successful businesses as a global company. We encourage applicants from across diverse backgrounds, race, ethnicities, religion, age, marital status, gender, sexual orientations, or disabilities to apply. We empower our global workforce by offering flexible workplace arrangements, mentoring, internal mobility, learning and development programs, and more.

All employment decisions at Synechron are based on business needs, job requirements and individual qualifications, without regard to the applicant’s gender, gender identity, sexual orientation, race, ethnicity, disabled or veteran status, or any other characteristic protected by law.