Staff AppSec Engineer — Secure SDLC & Supply Chain

Shield AI; United States; Remote; USD 143,000 - 214,000; Full time

Job summary

Shield AI is seeking a Staff Application Security Engineer to lead and mature a scalable, developer-focused secure software lifecycle program. You will translate policies into practical engineering practices, partner with product, platform, and development teams, and advance enterprise-wide secure development and software-supply-chain maturity.

This role blends deep application-security expertise with program leadership, driving secure coding, tooling, and governance across the organization.

Qualifications

• Proven experience designing, implementing, or maturing a secure SDLC or application-security program across multiple teams.
• Strong knowledge of secure coding practices, application-security testing, vulnerability management, and DevSecOps principles.
• Hands-on with SAST/DAST/SCA and related tooling; adept at integrating controls into pipelines.

Responsibilities

• Establish and improve company-wide secure SDLC policies, standards, and procedures.
• Translate security requirements into actionable development tasks without adding friction.
• Lead threat modeling, security requirements, and design reviews for high-risk apps and integrations.
• Develop and maintain secure development guidance, reference architectures, and guardrails.
• Partner with Dev teams to triage, remediate, and verify findings; ensure actionable results.

Skills

Secure SDLC

DevSecOps

Threat modeling

Communication

Policy translation

Open-source governance

SBOM knowledge

Regulatory frameworks

Executive reporting

Tools

SAST

DAST

SCA

Secrets scanning

IaC security

Container security

API security

CI/CD security tooling

Job description

Shield AI is seeking a Staff Application Security Engineer to lead and mature a scalable, developer-focused secure software lifecycle program. You will translate policies into practical engineering practices, partner with product, platform, and development teams, and advance enterprise-wide secure development and software-supply-chain maturity.

This role blends deep application-security expertise with program leadership, driving secure coding, tooling, and governance across the organization.