Senior Application Security Engineer: Attack Surface Lead

Fidelity Information Services, LLC; Jacksonville (FL); On-site; USD 140,000 - 210,000; Full time

Benefits offered by this job

Modern work environment

Education opportunities

Growth opportunities

Collaborative culture

Challenging projects

Job summary

FIS is seeking a Senior Application Security Engineer to lead hands-on security across web, API, mobile, cloud-native, and AI-enabled applications. You will conduct deep assessments, shape encryption standards, and drive secure development practices across engineering teams.

You will own and improve the attack surface program, perform SAST/DAST, review code, lead API security assessments, and mentor junior staff while aligning with PCI DSS and industry standards.

Qualifications

• 9+ years of experience in software development and application security, with at least 5 years in SAST, DAST, SCA, API security, secure code review, threat modeling and container security.
• Experience with application, API and mobile security assessments using Burp Suite, Checkmarx, OWASP ZAP, Postman, AppScan, WebInspect, Fortify, Veracode or Semgrep.
• Hands-on Android and iOS penetration testing with MobSF, Frida, Objection, Jadx, Hopper/Ghidra and Xcode/Android Studio; knowledge of MASVS/MASTG.
• Strong manual code review in at least two major languages; identify complex vulnerabilities beyond automated tooling.
• OWASP Top 10, OWASP API Top 10, SANS/CWE Top 25; attack techniques; remediation guidance.
• Secure IaC and containers with Checkov, tfsec, KICS, Trivy, Grype, Snyk Container; Docker/Kubernetes knowledge.
• Cryptography, TLS, key management, PKI, secure secrets handling; write/review encryption policies.
• CI/CD security testing in Jenkins, GitHub Actions, GitLab CI, Azure DevOps.
• PCI DSS alignment for secure software development.
• Excellent communication to translate risk to engineers and leadership.

Responsibilities

• Own and improve the application attack surface management program across internet-facing apps, APIs, mobile apps and cloud assets.
• Lead SAST/DAST, tune rules, triage findings and integrate scanning into CI/CD pipelines.
• Perform deep manual source code reviews across Java, C#/.NET, Python, JS/TS, Cobol, Go, Kotlin/Swift.
• Lead API security assessments for REST/GraphQL/gRPC/SOAP: OAuth, JWT, mTLS, authorization, rate limiting.
• Conduct threat modeling sessions (STRIDE/PASTA), produce data flow diagrams and trust boundary analyses.
• Perform Android/iOS pentesting; assess root/jailbreak, tamper detection, pinning bypass, data storage risks.
• Run SCA to identify vulnerable OSS; drive license risk assessments and supply chain security.
• Assess IaC templates for misconfigurations; enforce guardrails via policy-as-code.
• Secure containerized workloads; review Kubernetes RBAC, network policies, secrets, sign images.
• Define encryption policies including TLS and key management aligned with FIPS/NIST.
• Review and update security policies and secure SDLC in response to threats and regulations.
• Apply AI in security; assess AI/LLM risks; speed up vulnerability triage with automation.
• Support PCI DSS compliance by mapping controls to requirements and evidence collection.
• Collaborate with dev/DevOps/cloud/product teams; provide risk ratings and remediation guidance.
• Mentor juniors, contribute to tooling and participate in architecture reviews.

Skills

SAST

DAST

API security

Threat modeling

Container security

Android/iOS pentesting

CI/CD security testing

Cryptography & data protection

CI/CD integration

Secure code review

Tools

Burp Suite Professional

Checkmarx

OWASP ZAP

Postman

AppScan

WebInspect

Fortify

Veracode

Semgrep

MobSF

Frida

Ghidra

Job description

FIS is seeking a Senior Application Security Engineer to lead hands-on security across web, API, mobile, cloud-native, and AI-enabled applications. You will conduct deep assessments, shape encryption standards, and drive secure development practices across engineering teams.

You will own and improve the attack surface program, perform SAST/DAST, review code, lead API security assessments, and mentor junior staff while aligning with PCI DSS and industry standards.