Staff Application Security Engineer (R5949)

Shield; United States; Remote; USD 140,000 - 190,000; Full time

Job summary

Shield AI is seeking a Staff Application Security Engineer to build a scalable, developer-centered secure SDLC program across the company. This role translates policy into practical engineering requirements, partnering with product, platform, and development teams to improve secure development and software supply-chain maturity.

You will lead assessment of CI/CD pipelines, define secure guidelines, and ensure security controls are practical, measurable, and integrated into existing engineering

Qualifications

• 7+ years of experience in application security or related field.
• Experience designing or maturing a secure SDLC across multiple engineering teams.
• Hands-on with SAST, DAST, SCA, and vulnerability management.
• Ability to read production code and explain risk to stakeholders.

Responsibilities

• Establish and improve company-wide secure SDLC policies, standards, and procedures.
• Translate policy into clear, actionable requirements for dev, product, and platform teams.
• Assess maturity of CI/CD pipelines, source-control, build and release processes; define improvement roadmaps.
• Develop secure-development guidance, reusable patterns, and developer enablement materials.
• Partner with development teams to identify, triage, remediate, and verify application-security findings.
• Evaluate and operationalize application-security tooling (SAST/DAST/SCA, secrets scanning, IaC security).

Skills

Secure SDLC

DevSecOps

SAST

DAST

SCA

Threat modeling

CI/CD security

Open-source risk

Education

Bachelor's degree in CS/IS

Tools

Snyk

Checkmarx

Veracode

GitHub Advanced Security

Job description

Shield AI is a venture-backed defense-tech company with the mission of protecting service members and civilians with intelligent systems. Its products include Hivemind autonomy software, V-BAT and X-BATaircraft, and Aechelon simulation and synthetic reality technologies. With offices and facilities across the U.S., Europe, the Middle East, and Asia-Pacific, Shield AI's technology actively supports operations worldwide. For more information, visit www.shield.ai. Follow Shield AI on LinkedIn, X, Instagram, and YouTube.

We are seeking a Staff Application Security Engineer to build and advance a scalable, developer-centered application security program. This role will establish company-wide secure software development lifecycle (SDLC) policy and standards, translate them into practical engineering practices, and partner directly with product, platform, and development teams to improve secure development and software supply-chain maturity.

The successful candidate combines technical application-security depth with the programmatic leadership to drive enterprise-wide improvement. You will help teams build, test, package, release, and maintain secure software while ensuring security controls are practical, measurable, and integrated into existing engineering workflows.

This is a Staff level individual-contributor role with significant influence across engineering, security, product, and technology leadership.

What you'll do:

• * Establish, maintain, and continuously improve company-wide secure SDLC policies, standards, control objectives, procedures, and supporting evidence requirements.
  * Translate security policy into clear, achievable requirements for development, product, and platform teams without creating unnecessary delivery friction.
  * Assess the maturity of development teams, CI/CD pipelines, source-control practices, build environments, and release processes; define and lead practical improvement roadmaps.
  * Develop secure-development guidance, reference architectures, reusable patterns, security guardrails, exception processes, and developer enablement materials.
  * Partner directly with development teams to identify, triage, prioritize, remediate, and verify application-security findings.
  * Evaluate, implement, tune, and operationalize application-security tooling, including:* Static application security testing (SAST)
  * Dynamic application security testing (DAST)
  * Software composition analysis (SCA)
  * Secrets detection
  * Infrastructure-as-code security scanning
  * Container and image security scanning
  * API and cloud-native application security controls

Required qualifications:

• * 7+ years of experience in application security, product security, DevSecOps, secure software engineering, cybersecurity engineering, or a closely related field.
  * Demonstrated experience designing, implementing, or maturing a secure SDLC or application-security program across multiple engineering teams.
  * Strong working knowledge of secure coding practices, application-security testing, vulnerability management, software delivery, and DevSecOps principles.
  * Experience working directly with developers to explain findings, guide remediation, and improve secure-development practices.
  * Hands-on experience with SAST, DAST, SCA, dependency vulnerability management, secrets scanning, and related application-security tooling.
  * Experience integrating security controls into source-control, CI/CD, build, release, and deployment workflows.
  * Experience performing or facilitating threat modeling, security design review, architecture review, or security requirements definition.
  * Knowledge of common application-security risks, including authentication, authorization, API security, insecure deserialization, injection vulnerabilities, insecure dependency use, secrets exposure, and business-logic vulnerabilities.
  * Experience with software supply-chain security concepts, including SBOMs, dependency provenance, build integrity, artifact signing, release attestations, and secure artifact management.
  * Experience with open-source software risk management, including vulnerable dependencies, transitive dependencies, license obligations, and governance processes.
  * Familiarity with NIST SP 800-218 / SSDF, OWASP SAMM, SLSA, or comparable secure-development and supply-chain security frameworks.
  * Ability to read and assess production code and scripts in one or more modern programming languages.
  * Strong written and verbal communication skills, including the ability to explain technical risk and tradeoffs to developers, leaders, auditors, and nontechnical stakeholders.

Preferred qualifications:

• * Experience implementing SLSA practices, signed software attestations, build provenance, hardened build systems, or release integrity controls.
  * Experience with VEX, CSAF, SBOM formats such as SPDX or CycloneDX, and component or vulnerability intelligence workflows.
  * Experience securing cloud-native applications, containers, Kubernetes, APIs, microservices, and infrastructure-as-code.
  * Experience with common source-control, CI/CD, cloud, artifact-management, package-management, or container-registry platforms.
  * Experience with tools such as Snyk, Checkmarx, Veracode, GitHub Advanced Security, GitLab security tools, Semgrep, SonarQube, OWASP ZAP, Burp Suite, Mend, Black Duck, or comparable technologies.
  * Experience with NIST SP 800-171, NIST SP 800-53, CMMC, FedRAMP, ISO 27001, SOC 2, or other regulated-environment requirements.
  * Experience supporting commercial software, government, defense, critical-infrastructure, or other high-assurance product environments.
  * Relevant certifications such as CSSLP, CISSP, GWAPT, GWEB, OSWE, GIAC, cloud-security certifications, or comparable credentials.

#LI-KE1

#LC

Full-time regular employee offer package:

Pay within range listed + Bonus + Benefits + Equity

Temporary employee offer package:

Pay within range listed above + temporary benefits package (applicable after 60 days of employment)

Salary compensation is influenced by a wide array of factors including but not limited to skill set, level of experience, licenses and certifications, and specific work location. All offers are contingent on a cleared background and possible reference check. Military fellows and part-time employees are not eligible for benefits. Please speak to your talent acquisition representative for more information.

Shield AI is proud to be an equal opportunity workplace and is an affirmative action employer. We are committed toequal employment opportunity regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, marital status, disability, gender identity or Veteran status. If you have a disability or special need that requires accommodation, please let us know.