Senior AppSec Engineer: Automate Secure CI/CD & APIs

Irvine TechNology Corporation; New York (NY); On-site; USD 240,000 - 260,000; Full time

Job summary

Irvine Technology Corporation (ITC) is seeking an experienced Application Security Engineer to build, mature, and scale its application security program. You will embed with Product and Engineering teams to secure home-grown software and third-party SaaS, acting as security consultant and hands-on engineer.

Responsibilities include embedding SAST/DAST in CI/CD, leading threat modeling on new features, reviewing API designs, and developing secure IaC patterns for Azure and Kubernetes.

Qualifications

• Significant hands-on application security experience with OWASP Top 10 and API security.
• Proficiency integrating SAST/SCA/DAST, container/IaC scanners, and secret scanning into CI/CD stacks.
• Experience with Terraform/IaC, Kubernetes, and cloud security (Azure preferred).

Responsibilities

• Embed SAST, SCA, DAST, container/IaC scanning, and secret detection tooling into CI/CD pipelines for home-grown applications.
• Lead security design and threat modeling sessions with Product and Engineering teams based on OWASP Top 10 and MITRE ATT&CK.
• Review API designs to eliminate authentication anti-patterns and token mismanagement.
• Define AppSec coverage, tooling, and assessment processes across the application landscape.
• Develop secure Infrastructure as Code patterns and validate security controls for Azure and Kubernetes.

Skills

OWASP Top 10

MITRE ATT&CK

API Security

CI/CD tooling

SAST/SCA/DAST

Terraform/IaC

Kubernetes

Azure

Tools

GitHub Actions

GitLab CI

Azure DevOps

Jenkins

OPA/Gatekeeper

Kyverno

Job description

Irvine Technology Corporation (ITC) is seeking an experienced Application Security Engineer to build, mature, and scale its application security program. You will embed with Product and Engineering teams to secure home-grown software and third-party SaaS, acting as security consultant and hands-on engineer.

Responsibilities include embedding SAST/DAST in CI/CD, leading threat modeling on new features, reviewing API designs, and developing secure IaC patterns for Azure and Kubernetes.