Senior AppSec Engineer: Secure, Automate & Lead DevSecOps

Esri; Town of Vienna (WI); On-site; USD 94,000 - 158,000; Full time

Job summary

Esri is seeking an experienced Application Security Engineer to secure Esri’s applications and data across a range of environments. You will design and operate security testing pipelines, review code for security, and guide development teams in remediation, working closely with DevSecOps and information security groups.

A strong emphasis is placed on collaboration, pragmatic security, and continuous improvement.

Qualifications

• 5+ years of experience in application security, including code reviews, penetration testing, and vulnerability management.
• Ability to assess risk using a consistent risk management framework.
• Experience developing automations with Python, TypeScript, Java or PowerShell.
• Expertise creating and maintaining GitHub Actions workflows and DevSecOps pipelines.
• Hands-on Kubernetes experience with security best practices and cloud platforms (AWS/Azure).
• Ability to read and analyze code for security vulnerabilities and to understand HTTP/OAuth/OIDC/REST etc.
• US citizenship and ability to obtain/maintain a US Security Clearance.
• Bachelor’s degree in computer science or related field.

Responsibilities

• Design, operate, and improve application security testing capabilities and pipelines.
• Assess application risks and recommend mitigations.
• Perform application layer security reviews across multiple languages.
• Assist with application layer penetration testing to identify issues.
• Provide security guidance and mentorship to development teams.

Skills

Python

TypeScript

Java

PowerShell

GitHub Actions

Kubernetes

Risk assessment

Web security

AWS

Azure

AI tools

Education

Bachelor's degree in computer science or related field

Tools

Job description

Esri is seeking an experienced Application Security Engineer to secure Esri’s applications and data across a range of environments. You will design and operate security testing pipelines, review code for security, and guide development teams in remediation, working closely with DevSecOps and information security groups.

A strong emphasis is placed on collaboration, pragmatic security, and continuous improvement.