Senior Application Security Engineer - Hybrid Role

Vanguard; Malvern (Chester County); Hybrid; USD 110,000 - 170,000; Full time

Job summary

Vanguard in Malvern is seeking an Application Security Specialist to help secure the software development lifecycle. You will develop strategy, implement technology, and collaborate with developers to embed guardrails for secure delivery.

The role focuses on CICD, secure SDLC, and testing initiatives (DAST, SAST, SCA, IAST) across containers, serverless, and APIs, while mentoring teams and reporting metrics to improve risk visibility.

Qualifications

• Undergraduate degree in a related field or equivalent combination of training and experience.
• Strong experience deploying and operating DAST tools with CI/CD integration.
• Experience with SAST, SCA, IAST, RASP and other security tools.
• Strong knowledge of development, build, and deployment pipelines (cloud, containers, serverless).
• Familiarity with NIST, OWASP, and MITRE standards.
• Certifications in app development, security, DevSecOps, or cloud are a plus.

Responsibilities

• Guide Application Security strategy and secure the SDLC across projects.
• Drive API, Container, and Application Security testing initiatives (DAST, etc.).
• Develop strategies for securing containers, serverless, APIs, and AI/ML tech.
• Provide hands‑on engineering support for security incidents and vulnerability management.
• Gather and report metrics to show security coverage, risk reduction, and maturity.

Skills

CI/CD pipelines

DAST tooling

SAST / SCA / IAST

Application security

Cloud & containers security

NIST / OWASP / MITRE

Secure software development

Threat & vulnerability management

Automation & tooling

Education

Bachelor's degree

Tools

DAST tools

SAST tools

SCA tools

IAST tools

RASP tools

CI/CD tooling

Job description

Vanguard in Malvern is seeking an Application Security Specialist to help secure the software development lifecycle. You will develop strategy, implement technology, and collaborate with developers to embed guardrails for secure delivery.

The role focuses on CICD, secure SDLC, and testing initiatives (DAST, SAST, SCA, IAST) across containers, serverless, and APIs, while mentoring teams and reporting metrics to improve risk visibility.