Senior Application Security Engineer

Cybersecurity Jobs; San Jose (CA); On-site; USD 140,000 - 210,000; Full time

Job summary

J2B Global LLC is seeking a Senior Application Security Engineer for a hands-on, contract role in San Jose, CA. The position focuses on finding, reproducing, and validating security issues across distributed systems and microservices, with an onsite schedule for five days a week.

With 8+ years of experience, you will build practical security tooling, perform deep source code reviews, and drive remediation into production-ready outcomes in collaboration with engineers and code owners.

Qualifications

• 8+ years of experience in software engineering or security engineering.
• Strong hands‑on programming and debugging in Java, C++, or Python.
• Experience with multiple programming languages preferred.
• Knowledge of application security, secure coding standards, and vulnerability remediation.

Responsibilities

• Develop security tools, testing utilities, vulnerability reproduction scripts, and automated validation frameworks.
• Assess architecture including trust boundaries, data flows, attack surfaces across distributed systems and microservices.
• Investigate scanner results, reproduce vulnerabilities, create PoCs, and separate true issues from false positives.
• Conduct detailed source code reviews to uncover security flaws and insecure coding practices.
• Review, test, and validate security patches including AI-generated and automated fixes.
• Build test harnesses and run unit, regression, and security tests to confirm remediation.
• Use threat modeling to identify architectural risks and recommend secure design practices.
• Evaluate vulnerabilities using CVE, CWE, OWASP Top 10 and remediation SLAs.
• Collaborate with engineers to implement fixes and support production deployment.
• Track vulnerabilities through lifecycle and contribute to secure SDLC improvements.

Skills

Java

C++

Python

Tools

SAST/DAST tools

PoCs

Job description

J2B Global LLC is hiring a Senior Application Security Engineer on a contract basis in San Jose, CA with an onsite schedule for 5 days a week. This role is hands‑on and focused on finding, reproducing, and validating application security issues across distributed systems and microservices, from early analysis through patch verification.

With 8+ years of experience, you will build practical security tooling and testing frameworks, perform deep source code reviews, and partner with engineers and code owners to drive remediation into production‑ready outcomes.

Responsibilities

• Develop security tools, testing utilities, vulnerability reproduction scripts, and automated validation frameworks using Java, C++, or Python.
• Assess application architecture, including trust boundaries, data flows, attack surfaces, and security weaknesses across distributed systems and microservices.
• Investigate security scanner results, reproduce vulnerabilities, create Proofs of Concept (PoCs), and separate true security issues from false positives.
• Conduct detailed source code reviews to uncover security flaws, insecure coding practices, potential exploits, and software regressions.
• Review, test, and validate security patches, including AI-generated and automated code fixes.
• Build test harnesses and execute unit, regression, and security tests to confirm remediation effectiveness.
• Use threat modeling methodologies to identify architectural risks and recommend secure design and implementation practices.
• Evaluate vulnerabilities using CVE, CWE, OWASP Top 10, severity classifications, and security remediation SLAs.
• Collaborate with software engineers, architects, and code owners to implement security fixes and support production deployment.
• Track vulnerabilities across their lifecycle and contribute to continuous improvements in secure software development.

Requirements

• 8+ years of experience in software engineering, security software development, application security, or security engineering.
• Strong hands‑on programming and debugging experience in at least one of Java, C++, or Python.
• Experience with multiple programming languages is preferred.
• Extensive ability in software development, code analysis, troubleshooting, and resolving complex technical issues.
• Strong understanding of application security, secure coding standards, vulnerability identification, and remediation approaches.
• Proven ability to reproduce vulnerabilities and validate fixes through coding, testing, and debugging.
• Proficiency in source code reviews and testing practices such as unit and regression testing, including identifying security-related defects.
• Knowledge of threat modeling frameworks including STRIDE and PASTA.
• Understanding of architectural trust boundaries, attack surfaces, data flows, and threat analysis.
• Familiarity with CVE, CWE, OWASP Top 10, vulnerability severity assessment, and security remediation SLAs.
• Experience building security test harnesses, test environments or PoCs for vulnerability validation.
• Ability to assess automated code changes and identify security issues, functional regressions, and implementation weaknesses.

Technologies

• Java, C++, Python
• STRIDE, PASTA
• CVE, CWE, OWASP Top 10
• SAST/DAST tools
• PoPs, AI-generated code