Senior Security Engineer: Shift-Left SDLC & AI Security

Highmark Health; Virginia; On-site; USD 103,000 - 165,000; Full time

Job summary

Highmark Health is seeking a Senior Security Engineer to join the Enterprise Application Security team, shaping how security is built into software. This high-impact role focuses on shift-left security, embedding security throughout the SDLC from code to production, and partnering with engineering to prevent vulnerabilities before they occur.

The ideal candidate thrives at the intersection of security engineering, architecture, developer enablement, and automation, building scalable security

Qualifications

• Bachelor's degree in Computer Science, Information Systems, or a closely related field.
• Experience implementing security guardrails in CI/CD pipelines.
• Experience with AI-assisted development security controls and governance.
• Experience with security scanners including SAST, DAST, and software composition analysis.

Responsibilities

• Design and enforce shift-left security controls across CI/CD pipelines and AI-enabled development workflows.
• Lead vulnerability risk reduction and establish remediation SLAs for critical/high findings.
• Automate and optimize the security toolchain and provide real-time security posture dashboards.
• Serve as embedded security advisor to engineering teams and deliver secure coding guidance.
• Define and measure AppSec KPIs and AI security metrics for leadership reporting.

Skills

Security engineering

Shift-left security

Developer enablement

AI security

Education

Bachelor's degree in CS/IS or related field

Master's degree preferred

Tools

SAST

DAST

Dependency Scanning

Container Scanning

Secret Detection

API Security Testing

Job description

Highmark Health is seeking a Senior Security Engineer to join the Enterprise Application Security team, shaping how security is built into software. This high-impact role focuses on shift-left security, embedding security throughout the SDLC from code to production, and partnering with engineering to prevent vulnerabilities before they occur.

The ideal candidate thrives at the intersection of security engineering, architecture, developer enablement, and automation, building scalable security