Senior Attack Surface Security Engineer

FIS INC (OLD FIS); Milwaukee (WI); On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

Modern, international work environment

Professional education and development

Challenging finance/tech projects

Collaborative, flexible culture

Career growth opportunities

Job summary

FIS is seeking a Senior Application Security Engineer to lead hands-on security across web, API, mobile, cloud-native and AI-enabled applications. You will perform deep technical assessments, including SAST, DAST, SCA, threat modelling, IaC and container security, and guide secure development practices across engineering teams.

You will partner with development, DevOps, cloud and product teams to remediate vulnerabilities, define encryption policies, and mentor junior staff while contributing to

Qualifications

• 9+ years in software development and application security.
• Hands-on with SAST/DAST/SCA, API security, and container security.
• Experience integrating security testing into CI/CD pipelines.
• Strong knowledge of OWASP Top 10 and API Security Top 10.
• Excellent communication with engineers and leadership.

Responsibilities

• Own and continuously improve the application attack surface management program.
• Perform and oversee SAST/DAST, tune rulesets and integrate into CI/CD pipelines.
• Conduct in-depth manual source code reviews across languages (Java, C#/.NET, Python, JavaScript/TypeScript, Cobol, Go, Kotlin/Swift).
• Lead API security assessments for REST, GraphQL, gRPC and SOAP services.
• Facilitate threat modelling sessions (STRIDE, PASTA) and produce actionable requirements.
• Perform Android and iOS app penetration testing.
• Run SCA to identify vulnerable open-source components and coordinate remediation.
• Assess IaC templates for misconfigurations and enforce policy-as-code.
• Secure containerised workloads and review Kubernetes configurations.

Skills

SAST & DAST testing

SCA & software composition analysis

Manual secure code review

Threat modelling (STRIDE/PASTA)

Android/iOS pentesting

CI/CD security integration

Threat & vulnerability management

Excellent communication

Education

OSCP

OSWE

GWAPT

GMOB

eMAPT

CSSLP

CISSP

CKS

Tools

Burp Suite Pro

Checkmarx

OWASP ZAP

Postman

AppScan

WebInspect

Fortify

Veracode

Semgrep

Checkov

tfsec

KICS

Trivy

Docker

Kubernetes

Job description

FIS is seeking a Senior Application Security Engineer to lead hands-on security across web, API, mobile, cloud-native and AI-enabled applications. You will perform deep technical assessments, including SAST, DAST, SCA, threat modelling, IaC and container security, and guide secure development practices across engineering teams.

You will partner with development, DevOps, cloud and product teams to remediate vulnerabilities, define encryption policies, and mentor junior staff while contributing to