Senior Application Security Engineer

Blue Cross Blue Shield of Nebraska; United States; Hybrid; USD 140,000 - 180,000; Full time

Job summary

Blue Cross and Blue Shield of Nebraska is seeking a Senior Application Security Engineer to lead and own our application security capabilities. This role focuses on implementing secure software development practices, with emphasis on SAST/DAST, AI-related code risk, and risk-based vulnerability management.

You will partner with engineering, architecture, and risk teams to deliver practical, scalable security solutions across the enterprise.

Qualifications

• Bachelor's degree in Computer Science, Information Security, or related field (or equivalent experience).
• 6 years of experience in application security, secure software development, or DevSecOps.
• Hands-on experience with SAST, DAST, and dependency scanning tools, including tuning and operational ownership.
• Strong understanding of application vulnerability classes (OWASP Top 10, APIs, authentication, authorization).
• Experience integrating security into CI/CD pipelines and development workflows.
• Proven ability to assess risk, prioritize remediation, and clearly communicate decisions.
• Comfort working independently, taking ownership, and driving outcomes with minimal oversight.
• Strong communication skills with the ability to work effectively with developers, architects, and leadership.

Responsibilities

• Own and operate application security tooling, including SAST, DAST, and software composition analysis.
• Embed application security into CI/CD pipelines and development workflows to support shift-left security.
• Perform secure code reviews and validate vulnerabilities for exploitability, impact, and remediation feasibility.
• Define and maintain secure coding standards, guidance, and reusable security patterns for development teams.
• Establish guardrails and review expectations for AI-assisted and AI-generated code, reducing unowned and unmanaged application risk.
• Partner with development teams to triage findings, reduce false positives, and drive effective remediation.
• Apply risk-based decision making aligned to organizational risk appetite and compliance frameworks (NIST, HIPAA, SOC 2).
• Support application threat modeling and identification of architectural security gaps.
• Collaborate with cloud, platform, and identity teams to ensure applications integrate securely with enterprise services.
• Contribute to audit readiness, evidence collection, and regulatory support related to application security controls.
• Reduce single-points-of-failure by documenting processes, mentoring others, and improving program resiliency.

Skills

Application security

CI/CD security

Risk assessment

Communication

Independent work

Education

Bachelor's degree in CS or related field

Tools

SAST tools

DAST tools

Dependency scanning

Azure PaaS

Job description

At Blue Cross and Blue Shield of Nebraska, we are a mission-driven organization dedicated to championing the health and well‑being of our members and the communities we serve. Our team is the power behind that promise. And, as the industry rapidly evolves and we seek ways to optimize business processes and customer experiences, there’s no greater time for forward‑thinking professionals like you to join us in delivering on it! As a member of Team Blue, you’ll find purpose, opportunities and the support you need to build a meaningful career and make a powerful impact in our community. The Senior Application Security Engineer will serve as a technical leader and owner of company application security capabilities. This role is responsible for implementing and operating secure software development practices across the enterprise, with a strong focus on static and dynamic code analysis, DevSecOps integration, AI‑related code risk, and risk‑based vulnerability management. We are looking for an experienced practitioner who can operate independently, take ownership of outcomes, and partner effectively with engineering, architecture, and risk teams to deliver practical, scalable security solutions. The ideal candidate will live within driving distance of the Omaha, Nebraska office. This position allows remote flexibility but will have 1 day per week in the office. If living in one of our approved states (Florida, Iowa, Kansas, Minnesota, Missouri, Nebraska, North Dakota, and Texas) – this person may travel to our headquarters based on business needs.

What you'll do:

• Own and operate application security tooling, including SAST, DAST, and software composition analysis, ensuring tools are tuned, effective, and aligned to business risk.
• Embed application security into CI/CD pipelines and development workflows to support shift-left security while minimizing developer friction.
• Perform secure code reviews and validate vulnerabilities for exploitability, impact, and remediation feasibility.
• Define and maintain secure coding standards, guidance, and reusable security patterns for development teams.
• Establish guardrails and review expectations for AI-assisted and AI-generated code, reducing unowned and unmanaged application risk.
• Partner with development teams to triage findings, reduce false positives, and drive effective remediation.
• Apply risk‑based decision making aligned to organizational risk appetite and compliance frameworks (NIST, HIPAA, SOC 2).
• Support application threat modeling and identification of architectural security gaps.
• Collaborate with cloud, platform, and identity teams to ensure applications integrate securely with enterprise services.
• Contribute to audit readiness, evidence collection, and regulatory support related to application security controls.
• Reduce single‑points‑of‑failure by documenting processes, mentoring others, and improving program resiliency.

To be considered for this position you must have:

• Bachelor's degree in Computer Science, Information Security, or a related field (or equivalent experience).
• 6 years of experience in application security, secure software development, or DevSecOps.
• Hands‑on experience with SAST, DAST, and dependency scanning tools, including tuning and operational ownership.
• Strong understanding of application vulnerability classes (OWASP Top 10, APIs, authentication, authorization).
• Experience integrating security into CI/CD pipelines and development workflows.
• Proven ability to assess risk, prioritize remediation, and clearly communicate decisions.
• Comfort working independently, taking ownership, and driving outcomes with minimal oversight.
• Strong communication skills with the ability to work effectively with developers, architects, and leadership.

The strongest candidates will also have:

• Experience in healthcare or other regulated industries.
• Familiarity with Azure PaaS and cloud‑native application architectures.
• Exposure to AI‑assisted development risks, automation, or modern code‑generation tools.
• Threat modeling experience and security design review participation.
• Scripting or automation experience (Python, PowerShell, Bash).
• Relevant certifications (CSSLP, GWAPT, CISSP, or equivalent).
• An equivalent combination of education and experience may be substituted for this requirement.
• The ability to meet or exceed the attendance and timeliness requirements of their departments.
• On‑call work may be required based on business needs and role assignment.
• The ability to work well in a team environment and be capable of building and maintaining positive relationships with other staff, departments, and customers.

To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed are representative of the knowledge, skill, and or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. Other duties may be assigned.

What We Offer You

Learn more about what makes BCBSNE such an exceptional place to work, including details about our comprehensive Total Rewards package, by visiting NebraskaBlue.com/Careers.

We strongly believe that diversity of experience, perspective and background will lead to a better workplace for our employees and a better product for our customers and members.

BCBSNE is an Equal Opportunity /Affirmative Action Employer, M/F/D/V. If you are a qualified individual with a disability or a disabled veteran, you have the right to request an accommodation if you are unable or limited in your ability to use or access our career center as a result of your disability. To request an accommodation, contact a Human Resources Representative at BCBSNE.

On the cutting edge of the health care industry, helping Nebraskans in moments of joy, times of hardship and the steps in between. We are Blue Cross and Blue Shield of Nebraska (BCBSNE), and we exist to be there for people when they need us. Our goal is to add more good, healthy years to people’s lives by supporting our customers and the Nebraska community at large. We have more than 80 years of experience behind us. And a bright future ahead as we continuously innovate to drive health care forward while meeting the needs of our members and state. If you’re passionate about helping people along their health journeys, we invite you to explore our career offerings. Here, you will find opportunities to grow personally and professionally while making a difference for our customers and greater Nebraska community.