Senior Application Security Engineer - Hybrid NYC

STEPS Talent; New York (NY); Hybrid; USD 140,000 - 200,000; Full time

Job summary

STEPS Talent in New York City is seeking a Senior Security Engineer - Application Security to join a hybrid team protecting applications, cloud infrastructure, systems, and customer data. You will collaborate with engineering to embed security in the SDLC and drive secure design and implementation.

Requirements include 4+ years in application or software security, strong OWASP knowledge, API security experience, and cloud security with AWS/GCP/Azure.

Qualifications

• 4+ years in application, product, or software security or security-focused transition from software engineering.
• Strong understanding of vulnerabilities and attack techniques including OWASP Top 10 and API security risks.
• Experience testing modern web apps, APIs, and distributed systems manually.
• Ability to assess architecture and source code for security weaknesses.
• Experience integrating security tools into CI/CD workflows.
• Familiarity with SAST, DAST, secrets detection, container and dependency scanning, IaC scanning.
• Understanding authentication, authorization, session management, cryptography, and secure API design.
• Cloud security experience with AWS, GCP, or Azure; proficiency with programming languages and security tooling.

Responsibilities

• Develop and implement application security controls across the SDLC.
• Partner with engineering to embed security in architecture, design, and deployment.
• Perform hands-on security testing of web apps, APIs, and cloud services.
• Enhance automated security testing in CI/CD pipelines (static, dynamic, secrets, container scans).
• Evaluate tools, reduce false positives, and minimize developer friction.
• Review architecture and code for weaknesses and document secure coding standards.
• Support vulnerability management, incident response, and third-party risk assessments.
• Ensure compliance with healthcare and data protection requirements (HIPAA, GDPR).

Skills

Application security

OWASP Top 10

API security

CI/CD security

Cloud security

Web app security

Code security testing

SAST/DAST

Secure coding

Security testing

Tools

SAST tools

DAST tools

Secrets detection tools

Container scanning tools

Dependency scanning tools

IaC scanning tools

Job description

STEPS Talent in New York City is seeking a Senior Security Engineer - Application Security to join a hybrid team protecting applications, cloud infrastructure, systems, and customer data. You will collaborate with engineering to embed security in the SDLC and drive secure design and implementation.

Requirements include 4+ years in application or software security, strong OWASP knowledge, API security experience, and cloud security with AWS/GCP/Azure.