Senior AppSec Engineer & AVP — API & CI/CD Security

JobCubby; Salt Lake City, Northern (UT, KY); Hybrid; USD 100,000 - 130,000; Full time

Job summary

iCapital is seeking a hands-on Application Security practitioner to join a small, high-impact team building a modern AppSec program. This individual will work directly with the Head of AppSec and senior team members, executing secure design, API security, and developer enablement.

Responsibilities include threat modeling, shift-left security in CI/CD, and Python automation to scale AppSec capacity, while collaborating with developers to remediate SAST and SCA findings and foster secure coding

Qualifications

• Hands-on experience in secure design and threat modeling or SAST/SCA program work.
• Understanding of attack patterns and exploitation techniques.
• Familiarity with OWASP Top 10 in practice.
• API security experience with REST and GraphQL

Responsibilities

• Support threat modeling and design reviews across a broad and growing service portfolio.
• Support shift-left security initiatives, security in CI/CD, developer guidance, and SAST and SCA remediation workflows.
• Contribute to API security across the organization, assessing API exposure, validating authentication and authorization patterns.
• Write Python automation that scales AppSec capacity: triage tooling, finding pipelines, security context enrichment.
• Work directly with developers to remediate SAST and SCA findings, reduce false positive noise, and build security habits across engineering.

Skills

Threat modelling

API security

SAST/SCA

Python automation

OWASP Top 10

Job description

iCapital is seeking a hands-on Application Security practitioner to join a small, high-impact team building a modern AppSec program. This individual will work directly with the Head of AppSec and senior team members, executing secure design, API security, and developer enablement.

Responsibilities include threat modeling, shift-left security in CI/CD, and Python automation to scale AppSec capacity, while collaborating with developers to remediate SAST and SCA findings and foster secure coding