Senior AppSec Specialist – Threat Modelling & Secure Design

Spencer Rose; Woodbridge Township (NJ); Hybrid; USD 140,000 - 180,000; Full time

Job summary

Spencer Rose, Iselin, New Jersey, seeks an Application Security Specialist (Vice President) to assess real-world application risk and guide engineers in secure design and remediation. The role is hands-on, partnering with developers and focusing on translating findings into actionable risk decisions.

The position offers hybrid work with two days in the New Jersey office and includes an annual discretionary bonus. CISSP/CSSLP/GWAPT/GWEB or equivalent is preferred but not required.

Qualifications

• 5+ years of experience in application security, secure coding, vulnerability management and secure-by-design practices.
• Knowledge of OWASP Top 10 and common vulnerabilities.
• Ability to read code, validate findings, identify root causes and advise on remediation.
• Experience with threat modelling and secure design reviews.
• Practical knowledge of SAST, DAST, SCA, API security, and secrets detection.

Responsibilities

• Analyse and validate findings from SAST, DAST, SCA, API security testing and code reviews.
• Assess vulnerabilities based on exploitability, business impact, compensating controls and risk.
• Partner with developers to prioritize remediation and implement secure solutions.
• Lead threat modelling, secure design reviews and architecture risk reviews.
• Promote secure coding standards and reusable security patterns.
• Provide AppSec expertise to improve security testing and SDLC processes.

Skills

AppSec experience

OWASP Top 10

Threat modelling

Secure coding

Code review

SAST/DAST/SCA

AI-assisted analysis

Communication

Education

CS/Cybersecurity degree

Tools

SAST tools

DAST tools

SCA tools

API security testing

Job description

Spencer Rose, Iselin, New Jersey, seeks an Application Security Specialist (Vice President) to assess real-world application risk and guide engineers in secure design and remediation. The role is hands-on, partnering with developers and focusing on translating findings into actionable risk decisions.

The position offers hybrid work with two days in the New Jersey office and includes an annual discretionary bonus. CISSP/CSSLP/GWAPT/GWEB or equivalent is preferred but not required.