Senior AppSec Engineer - AI, CI/CD & Secure SDLC

Jobot Consulting; Charlotte (NC); Hybrid; USD 83,000 - 96,000; Full time

Job summary

Jobot Consulting is seeking an experienced Application Security Engineer to scale our enterprise AppSec program. You’ll partner with engineering leaders, embed tooling into CI/CD, and drive AI-enabled security workflows across multiple business units.

The role blends hands-on security engineering with strategy, enabling secure development practices while maintaining delivery velocity, in a hybrid work model with three days onsite weekly.

Qualifications

• 7+ years of experience in application security, product security, or security engineering.
• 3+ years of experience supporting complex environments with multiple independent units.

Responsibilities

• Lead discovery and inventory across multiple business units with ownership mapping and risk tiering.
• Implement and operate modern AppSec tooling (SAST, SCA, secrets scanning, container security, IaC scanning).
• Embed security tooling into CI/CD pipelines to integrate security into the development lifecycle.
• Design AI-assisted triage workflows to prioritize findings and reduce false positives.
• Evolve secure SDLC standards and threat modeling practices (STRIDE/PASTA).
• Develop AppSec playbooks with engineering leaders to balance security and delivery speed.
• Explore AI capabilities in application security, including AI-assisted code review and remediation guidance.
• Develop metrics and executive reporting linking security initiatives to risk reductions.

Skills

AppSec expertise

CI/CD integration

Python scripting

REST APIs

Security tooling

Threat modeling

Influencing without authority

Tools

Semgrep

Snyk

Checkmarx

Veracode

Apiiro

Ox Security

GitHub Advanced Security

Job description

Jobot Consulting is seeking an experienced Application Security Engineer to scale our enterprise AppSec program. You’ll partner with engineering leaders, embed tooling into CI/CD, and drive AI-enabled security workflows across multiple business units.

The role blends hands-on security engineering with strategy, enabling secure development practices while maintaining delivery velocity, in a hybrid work model with three days onsite weekly.