Senior AppSec Engineer: Secure SDLC & AI APIs

myhrhome; Irving (TX); On-site; USD 140,000 - 190,000; Full time

Job summary

OneMain Holdings, Inc. is seeking an experienced Application Security Engineer to lead the implementation and continuous improvement of security tooling across software delivery.

You will work with engineering to embed secure-by-design practices and enforce secure SDLC governance. You will manage API security, SAST/DAST/IAST, and software supply chain security, and collaborate with stakeholders to raise security maturity and automate controls in pipelines.

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related field.
• 5+ years of application security engineering experience.
• Experience implementing and administering application security platforms including SAST, DAST, SCA, IAST, container security, API security testing, and software supply chain security capabilities.
• Experience securing APIs across the development lifecycle, including API discovery, authentication/authorization validation, schema testing, and remediation guidance.
• Experience integrating security tooling and automated security controls into CI/CD pipelines using infrastructure-as-code (IAC).
• Experience supporting secure SDLC governance, policy enforcement, compliance reporting, and remediation management.
• Working knowledge of application security principles, secure coding, OWASP Top 10, and remediation techniques.
• Experience developing and maintaining technical standards, procedures, policies, and security documentation.
• Strong written and verbal communication skills with the ability to influence technical stakeholders.
• Ability to independently manage moderately complex security initiatives and contribute to broader cybersecurity objectives.
• Industry certifications such as CSSLP, GSEC, CISSP, GWAPT, or similar (preferred).
• Experience supporting financial services or other highly regulated environments (preferred).
• Experience assessing AI-assisted software development workflows, secure use of code-generation tools, guardrails, and risk monitoring (preferred).
• Experience with security automation, scripting, and workflow orchestration (preferred).
• Experience creating security metrics and dashboards (preferred).

Responsibilities

• Implement, administer, and continuously improve application security tooling supporting secure software development.
• Integrate security testing and security controls into software delivery pipelines and engineering workflows.
• Develop, maintain, and enhance application security standards, policies, procedures, documentation, and operational guidance.
• Analyze security findings, metrics, and compliance trends to identify improvements and elevated risk areas.
• Partner with engineering teams to improve security adoption and enable secure-by-design development practices.
• Support secure SDLC governance, vulnerability management, and remediation tracking activities.
• Collaborate with cybersecurity, architecture, platform, and engineering stakeholders to improve application security maturity.
• Contribute to security automation initiatives that increase efficiency and reduce manual effort.
• Support secure implementation of emerging software development practices, including AI-assisted development workflows.

Skills

Application security engineering

SAST/DAST/IAST

API security testing

CI/CD security/IaC

Security standards & governance

Education

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or related field

Tools

SAST tools

DAST tools

IAST tools

Container security tooling

API security testing tools

Job description

OneMain Holdings, Inc. is seeking an experienced Application Security Engineer to lead the implementation and continuous improvement of security tooling across software delivery.

You will work with engineering to embed secure-by-design practices and enforce secure SDLC governance. You will manage API security, SAST/DAST/IAST, and software supply chain security, and collaborate with stakeholders to raise security maturity and automate controls in pipelines.