Senior Application Security Engineer — Cloud, AI & Automation

Bloomberg BNA; Arlington (VA); On-site; USD 140,000 - 180,000; Full time

Job summary

Bloomberg Industry Group is seeking an Application Security Engineer III to lead security engineering initiatives and guide teams across the SDLC. You will design scalable controls for cloud‑native apps, perform risk assessments, and drive automation in security testing and deployment.

The role requires deep expertise in AppSec, strong coding skills (Python/Java/JavaScript), and experience with SAST/DAST/SCA, IaC, containers, and Kubernetes.

Qualifications

• Deep expertise in application security and risk management, including OWASP ASVS, OWASP Top10, and NIST800-53.
• Experience conducting complex security assessments and building automated security controls for large engineering environments.
• Proficiency in multiple programming languages (Python, Java, JavaScript) and hands‑on experience with SAST, DAST, SCA, IaC, container, and cloud security tools.
• Strong understanding of modern architectures (cloud‑native, microservices, Kubernetes, containers, serverless) and DevSecOps processes.

Responsibilities

• Design and implement security architectures and controls for large‑scale, cloud‑native applications.
• Conduct in‑depth risk assessments, including penetration testing and code reviews.
• Collaborate with developers and DevOps to integrate security across the SDLC.
• Drive security for AI‑powered features by defining secure architectures and testing AI models and MCP servers.

Skills

Python

Java

JavaScript

SAST

DAST

SCA

IaC

Kubernetes

Containers

Education

Bachelor's degree in Information Security or Computer Science

Tools

AWS

GCP

Azure

Job description

Bloomberg Industry Group is seeking an Application Security Engineer III to lead security engineering initiatives and guide teams across the SDLC. You will design scalable controls for cloud‑native apps, perform risk assessments, and drive automation in security testing and deployment.

The role requires deep expertise in AppSec, strong coding skills (Python/Java/JavaScript), and experience with SAST/DAST/SCA, IaC, containers, and Kubernetes.