Senior Application Security Engineer — Enterprise & Vendors

Lurie Children's Hospital; Chicago (IL); On-site; USD 94,000 - 154,000; Full time

Benefits offered by this job

Medical, dental and vision insurance

Employer paid life and disability

Health Savings Account contribution

Paid Time Off and holidays

Job summary

Ann & Robert H. Lurie Children’s Hospital of Chicago is seeking an Application Security Engineer to implement, validate, and maintain security controls across the hospital’s application stack, including databases, middleware, web server, API, and presentation layers.

The engineer ensures applications, integrations, and supporting components are securely configured, monitored, and aligned with enterprise security standards.

Qualifications

• Bachelor’s Degree in Computer Science, Information Security, Information Systems, or related field, or equivalent work experience.
• 3–7+ years of experience in application security, cybersecurity, or enterprise application support.
• Experience working in large enterprise environments with multiple commercial applications and integrations preferred.
• Experience within a healthcare provider environment is desirable.
• Security certifications such as CISSP, CSSLP, GWAPT, CASE, CEH, OSCP or equivalent are beneficial but not required.

Responsibilities

• Serve as the central authority for application and integration risk by applying consistent security standards across a portfolio of more than 250 commercial and third‑party applications.
• Identify and reduce application‑layer risk across third‑party applications, APIs, system integrations, automated file transfers, and service accounts.
• Interface with application vendors, application owners, and other departments as needed.
• Assess and secure internet‑facing applications by identifying exposed access points and prioritizing remediation of high‑risk entry vectors.
• Enforce standardized security controls for authentication, authorization, credential and secret management, encryption, and secure communication patterns.
• Partner with application owners and vendors to eliminate insecure configurations, excessive access, credential misuse, and other security issues.
• Evaluate and secure applications throughout their lifecycle including procurement, implementation, integration, and ongoing operations.
• Support third‑party risk management by assessing vendor integrations, data flow methods, and exposure points.
• Drive remediation of application vulnerabilities identified through vulnerability scanning (e.g., Qualys), configuration reviews, and security testing of externally facing systems.
• Improve visibility and governance over application security posture by tracking exposure trends, risk reduction, and remediation progress.

Skills

Application-layer security

Authentication & authorization

Encryption & data protection

Enterprise security experience

OWASP Top 10 & IAM

CIS Controls & Benchmarks

Vulnerability scanning tools

Network & edge security

Cross-functional remediation

Risk-based prioritization

Technical communication

Education

Bachelor’s Degree in CS/Info Security/Info Systems or related field

Security certifications (CISSP, CSSLP, GWAPT, CASE, CEH, OSCP)

Tools

Qualys

Qualys WAS

Metasploit

SAST/DAST

Configuration/Exposure analysis tools

Job description

Ann & Robert H. Lurie Children’s Hospital of Chicago is seeking an Application Security Engineer to implement, validate, and maintain security controls across the hospital’s application stack, including databases, middleware, web server, API, and presentation layers.

The engineer ensures applications, integrations, and supporting components are securely configured, monitored, and aligned with enterprise security standards.