Senior AppSec Engineer: Secure Cloud-Native Platforms

PowerSchool; Plano (TX); On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Medical, dental, vision insurance

401(k) plan

Parental leave

Paid time off

Wellness program

Tuition reimbursement

Pet insurance

Identity theft protection

Student debt repayment program

Prepaid legal coverage

Job summary

PowerSchool is seeking an Application Security Engineer to integrate security across the software development lifecycle. You will partner with engineering, architecture, product, and DevOps to identify threats, perform secure reviews, and guide remediation in a cloud-based, SaaS environment.

You will lead security testing programs (SAST, DAST, SCA, secret scanning), develop secure coding guidance, and help build a security-first culture across PowerSchool's product teams in Plano, Texas.

Qualifications

• 5+ years of experience in application security, software security, secure software development, DevSecOps, or a related discipline.
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Software Engineering, or a related field; or equivalent combination of education, training, and experience.
• Experience performing threat modeling, secure design reviews, and application security assessments.
• Experience identifying and mitigating common web application and API vulnerabilities, including those described by the OWASP Top 10 and OWASP API Security Top 10.
• Experience supporting application security testing technologies, including SAST, DAST, SCA, secret scanning, and related security tooling.
• Strong understanding of secure coding principles, software architecture, and secure development practices.
• Knowledge of authentication, authorization, session management, cryptography, API security, and software supply chain security concepts.
• Experience working with software development teams to remediate security findings and implement secure solutions.
• Familiarity with modern software development methodologies, CI/CD pipelines, and DevOps practices.
• Knowledge of cloud technologies and security concepts within AWS and/or Microsoft Azure environments.
• Strong analytical, communication, presentation, and stakeholder management skills.
• Ability to communicate technical security concepts effectively to developers, engineers, and business stakeholders.

Responsibilities

• Partner with development, architecture, product, and DevOps teams to integrate security throughout the software development lifecycle.
• Perform threat modeling exercises to identify potential attack vectors, security risks, and required security controls for new and existing applications.
• Conduct secure architecture and design reviews to identify security weaknesses and recommend effective mitigations early in the development process.
• Provide security guidance and consultation to engineering teams regarding secure coding practices, application security risks, and security requirements.
• Manage and support application security testing programs, including static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), secret scanning, and related security technologies.
• Analyze, validate, prioritize, and communicate application security findings to development teams and other stakeholders.
• Work with engineering teams to develop remediation plans and track security issues through resolution.
• Establish, maintain, and continuously improve application security standards, secure coding requirements, and secure development lifecycle processes.
• Evaluate third‑party software components, open‑source dependencies, and software supply chain risks to identify potential security concerns.
• Support software bill of materials (SBOM) initiatives and software supply chain security activities.
• Develop security requirements, security patterns, and implementation guidance for web applications, APIs, cloud‑native applications, and supporting services.
• Collaborate with Offensive Security Engineers to review penetration test findings and drive corrective actions where appropriate.
• Design and deliver application security training, awareness materials, and developer enablement programs.
• Support security champions and other security advocate programs within engineering organizations.

Skills

Application security

Threat modeling

Secure coding

DevSecOps

Cloud security

Communication skills

Stakeholder mgmt

Education

Bachelor's degree or equivalent

Tools

SAST

DAST

SCA

Secret scanning

SBOM tooling

Job description

PowerSchool is seeking an Application Security Engineer to integrate security across the software development lifecycle. You will partner with engineering, architecture, product, and DevOps to identify threats, perform secure reviews, and guide remediation in a cloud-based, SaaS environment.

You will lead security testing programs (SAST, DAST, SCA, secret scanning), develop secure coding guidance, and help build a security-first culture across PowerSchool's product teams in Plano, Texas.