Senior AppSec Engineer II — AI/ADLC Leader (Remote)

Spring Health; United States; Remote; USD 180,000 - 206,000; Full time

Benefits offered by this job

Health benefits and medical coverage

401(k) match

No-cost therapy visits

Paid time off

Job summary

Spring Health in the United States is seeking a Senior Application Security Engineer II to mature SAST/DAST/SCA programs and shape a Secure AI Development Lifecycle. You will join a growing team of engineers to raise our AppSec posture and guide security across the development lifecycle.

You will mentor, perform secure code reviews, and automate workflows using Go, Python, JavaScript, or Ruby, while evaluating AI-enabled product features and LLM security risks.

Qualifications

• 7+ years of professional experience in application security or a closely related security engineering discipline.
• Hands-on experience with DAST, SAST, and SCA tools, and manual testing techniques (OWASP, SANS Top 25).
• Demonstrated experience securing CI/CD pipelines with tooling.
• Experience with IaaS cloud infrastructure (AWS/Azure/GCP), containers, and SOA.
• Security automation in Go, Python, JavaScript, or Ruby.
• Familiarity with AI/ML security concepts — prompt injection, adversarial inputs, model supply-chain risks.
• Working knowledge of AI/LLM tooling to assess risk and automate workflows.
• Experience implementing controls aligned to NIST CSF, HIPAA, HITRUST, ISO-27001, SOC-2.
• Strong cross-functional collaboration with engineering, product, and leadership.
• Bachelor’s degree or equivalent work experience.

Responsibilities

• Advance secure-by-design practices within the S-SDLC through reviews and guidance.
• Mentor engineers on secure coding and AppSec fundamentals for career growth.
• Develop AI-assisted threat modeling and scale it across the organization.
• Strengthen SAST/SCA/DAST programs by tuning rules and improving coverage.
• Perform security-focused code reviews of internal and open-source libraries.
• Support remediation efforts and validate fixes per workflows.
• Identify process improvements and implement security automation (Go, Python, JS, Ruby).
• Assess security of AI-enabled features, including LLM APIs and RAG pipelines.
• Contribute to ADLC research aligned with OWASP Top 10 for LLM apps.

Skills

DAST

SAST

SCA

CI/CD security

Cloud: AWS/Azure/GCP

Security automation

Go

Python

JavaScript

Ruby

AI/ML security

LLM security

NIST/HIPAA/ISO-27001/SOC-2

Cross-functional collaboration

Bachelor’s degree

Education

Bachelor’s degree in CS/Engineering or equivalent

Tools

OpenAI tooling

Anthropic tooling

LangChain

Job description

Spring Health in the United States is seeking a Senior Application Security Engineer II to mature SAST/DAST/SCA programs and shape a Secure AI Development Lifecycle. You will join a growing team of engineers to raise our AppSec posture and guide security across the development lifecycle.

You will mentor, perform secure code reviews, and automate workflows using Go, Python, JavaScript, or Ruby, while evaluating AI-enabled product features and LLM security risks.