Senior AppSec Engineer: Threat Modeling & Secure SDLC

Mach7 Technologies; New Jersey; On-site; USD 120,000 - 190,000; Full time

Job summary

Mach7 Technologies seeks an experienced security engineer to lead AppSec and secure SDLC initiatives across web, API, mobile, and shipped product deliverables. You will model attack surfaces, drive prioritization across security streams, and perform secure reviews throughout development.

Colonial security stack includes threat modeling, SBOM governance, and advancing SCA/SAST/DAST in CI/CD. Strong communication is essential to align engineers and executives on risk and remediation.

Qualifications

• 5+ years of experience in security engineering with a strong AppSec focus.
• Proficiency with threat modeling frameworks (STRIDE, PASTA, or similar).
• Proficiency with common AppSec tooling: Semgrep, Snyk, Burp Suite, OWASP ZAP, or equivalents.
• Deep understanding of web application vulnerabilities (OWASP Top 10, API security, auth/authz flaws).
• Ability to read and reason about code in at least two languages; prior development experience a plus.
• Experience with software supply chain security — SBOM generation and analysis (CycloneDX, SPDX), SCA tooling, and dependency risk management.
• Strong written and verbal communication skills — you can explain risk to both engineers and executives.

Responsibilities

• Own and evolve the AppSec program across the SDLC for web, API, mobile, and shipped product deliverables.
• Build and maintain a living model of the product attack surface to drive prioritization across security workstreams.
• Conduct threat modeling and architecture security reviews for new features and releases.
• Perform secure code reviews across multiple languages (e.g., Python, Go, TypeScript, C/C++).
• Integrate and tune SAST, DAST, and SCA tooling within CI/CD pipelines (GitHub Actions, Jenkins).
• Triage and remediation of vulnerabilities from scanning, bug bounty, and pen tests.
• Develop and maintain security standards, patterns, and guardrails.

Skills

Threat modeling

AppSec

Security tooling

Code review

SBOM/ supply chain

Communication

Tools

Semgrep

Snyk

Burp Suite

OWASP ZAP

Job description

Mach7 Technologies seeks an experienced security engineer to lead AppSec and secure SDLC initiatives across web, API, mobile, and shipped product deliverables. You will model attack surfaces, drive prioritization across security streams, and perform secure reviews throughout development.

Colonial security stack includes threat modeling, SBOM governance, and advancing SCA/SAST/DAST in CI/CD. Strong communication is essential to align engineers and executives on risk and remediation.