Application Security Testing

Application Security Testing Engineer Jobs

9 jobs found

Today

Application Security Engineer

Firefly Aerospace Leander, TX

Leander, TX

Today

Full time Application Security Application Security Testing Application Security Testing

Apply Now

Job Description

Firefly Aerospace is building mission-critical capabilities for spacecraft operations, and the security of its ground software stack is central to that effort. In this onsite role in Leander, TX, you will help protect application systems that support spacecraft ground operations by designing and enforcing security controls end to end, from code practices to deployment and audits.

As an Application Security Engineer with 5+ years of experience, you will integrate security into development workflows, assess vulnerabilities using industry-standard tooling, and support government and national security requirements across classified and mission-critical environments.

Responsibilities

Design, implement, and maintain security controls for spacecraft ground software systems across front-end, back-end, databases, and cloud services.
Run software scanning, perform code reviews, and conduct vulnerability assessments using industry-standard tools and processes.
Define and enforce secure coding practices across development teams.
Integrate static and dynamic application security testing (SAST/DAST) into CI/CD pipelines.
Partner with developers to remediate vulnerabilities and design secure architectures.
Translate and implement government and national software security standards, including NIST and DoD STIGs.
Architect and maintain identity and access management (IAM), role-based access controls, and secure API authentication.
Collaborate with DevOps to deploy hardened software in containerized and cloud environments using Docker, Kubernetes, and AWS.
Support audits, security reviews, and Authority to Operate (ATO) processes for classified and mission-critical systems.

Requirements

BS in Computer Science, Software Engineering, Cybersecurity, or a related technical field.
5+ years of software engineering experience with a focus on application security.
Proficiency in modern programming frameworks including React, Node.js, and Python.
Hands-on experience with vulnerability scanning and application security testing tools such as SonarQube, Snyk, Fortify, Veracode, and OWASP ZAP.
Strong understanding of secure coding practices including OWASP Top 10 and CWE Top 25.
Knowledge of government and national security standards such as NIST 800-53, DoD STIGs, and FIPS 140-3.
Experience with container and cloud security including Docker, Kubernetes, AWS IAM, and Secrets Management.
Familiarity with CI/CD security integration.
Strong understanding of authentication and authorization, including correct encryption practices using vetted libraries, TLS, and secure secrets handling.
Experience working in high-reliability, safety-critical, or regulated environments.

Technologies

React, Node.js, Python
SonarQube, Snyk, Fortify, Veracode, OWASP ZAP
OWASP Top 10, CWE Top 25
NIST 800-53, DoD STIGs, FIPS 140-3
Docker, Kubernetes, AWS IAM, Secrets Management
CI/CD, SAST/DAST, TLS
Authority to Operate (ATO)

Benefits

Generous health, dental, and vision plans with low plan deductibles
Parental leave
Relocation benefits
Educational reimbursement
Short term disability
Flexible PTO options

Desired

Advanced degree or equivalent hands-on experience in a related technical field.
Experience deploying software to classified or government systems.
Prior involvement in achieving or maintaining an Authority to Operate (ATO).
Background in mission-critical or aerospace ground systems.
Hands-on experience supporting incident response from the remediation side, including root-cause analysis, coordinating fixes, and hardening.
Active security clearance (Secret or higher) or eligibility to obtain one.
Security certifications such as CISSP, CSSLP, CEH, or GIAC.

View full job page →

3d ago

Senior Application Security Engineer – Policy & Platform

Strategic Staffing Solutions Plano, TX

Plano, TX

3d ago

$60 - $66/hr Contract Senior Api Security Application Security

Apply Now

Job Description

Contract role for a Senior Application Security Engineer focused on policy and platform support, with a 12-month engagement and W2-only work terms. This hybrid position is based in Plano, TX 75023, with an option for San Antonio, TX or Plano, TX, and Visa sponsorship is available.

What you’ll do

You will provide technical expertise across the Application Security platform portfolio, supporting application security tooling and policy implementation. The role includes hands-on security analysis, platform escalation support, and enablement activities that help teams improve secure delivery outcomes.

Support Application Security platforms, tooling, and policy implementation.
Perform vulnerability analysis, including root-cause analysis and false-positive assessments.
Support security testing across SAST, SCA, API Security, DAST, Infrastructure-as-Code (IaC), and Mobile Security.
Administer and support AppSec platforms and security tooling.
Provide secure coding guidance and support vulnerability remediation for development teams.
Assist with platform escalations and developer enablement activities.
Collaborate with GitLab and CI/CD pipelines to support DevSecOps practices and automated security controls.
Use APIs, automation, and AI-assisted workflows to improve security operations.

What you bring

Deep understanding of Secure SDLC and Application Security practices.
Hands-on experience with SAST, SCA, API Security, DAST, Infrastructure-as-Code (IaC), and Mobile Security testing.
Experience administering and supporting AppSec platforms and related security tooling.
Experience validating findings through vulnerability validation, root-cause analysis, and false-positive assessments.
Experience providing secure coding guidance and remediation support to development teams.
Familiarity with GitLab, CI/CD pipelines, DevSecOps, and automated security controls.
Experience leveraging APIs, automation, and AI-assisted workflows to strengthen security operations.
Certifications such as CSSLP, CISSP, GWAPT, GWEB, or equivalent industry-recognized credentials.

Pay, location, and schedule

Location: San Antonio, TX or Plano, TX (Hybrid remote in Plano, TX 75023)
Work schedule: Hybrid, 4 days onsite / 1 day remote
Pay: $60.00 - $66.00 per hour on W2 (60–66 per hr on W2)
Contract term: 12 Months
Employment requirements: W2 Only. No C2C eligibility for this position.
Visa sponsorship: Available

Technologies you’ll work with

SAST, SCA, API Security, DAST
Infrastructure-as-Code (IaC), Mobile Security
GitLab, CI/CD pipelines, DevSecOps
APIs, AI-assisted workflows
CSSLP, CISSP, GWAPT, GWEB

View full job page →

6d ago

Senior Penetration Tester / Red Team Engineer

Cognizant New York, NY

New York, NY

6d ago

$134k - $155k/yr Full time Senior Api Penetration Testing Application Security

Apply Now

Job Description

Lead offensive security efforts to uncover exploitable weaknesses and strengthen enterprise cyber resilience through evidence-based penetration testing.

Responsibilities

Conduct comprehensive penetration testing across web applications, APIs, networks, cloud environments, mobile applications, and Windows/Linux systems.
Run vulnerability assessments using automated scanning platforms and manual testing to identify security weaknesses.
Simulate realistic adversary scenarios to evaluate authentication, authorization, access controls, network defenses, and overall security resilience.
Identify and validate vulnerabilities, misconfigurations, exposed credentials, insecure code, and potential attack paths across enterprise environments.
Use offensive security tools including Burp Suite, Metasploit, Nmap, Kali Linux, Pentera, and vulnerability scanning platforms.
Develop Python and Bash scripts, automation utilities, and custom testing approaches to improve testing efficiency and coverage.
Produce documentation covering assessment methodologies, technical evidence, risk impact, and findings, with clear remediation recommendations for stakeholders.
Collaborate with application, infrastructure, cloud, and security teams to remediate findings and validate fixes via retesting.
Research emerging threats, CVEs, OWASP vulnerabilities, exploitation techniques, and evolving offensive security methodologies.
Support security assessments, compliance initiatives, risk reviews, and continuous improvement of enterprise offensive security capabilities.

Requirements

8+ years of hands-on experience in Penetration Testing, Red Teaming, Offensive Security, or Security Engineering.
Expert-level experience delivering penetration tests across web applications, networks, APIs, endpoints, cloud platforms, and enterprise infrastructure.
Strong expertise in vulnerability exploitation, attack-path analysis, credential security, authentication testing, and security control validation.
Advanced hands-on experience with offensive security tools: Burp Suite, Metasploit, Nmap, Kali Linux, Pentera Console/Surface, and vulnerability scanners.
Strong scripting and automation skills using Python, Bash, PowerShell, or similar technologies.
Deep understanding of OWASP, CVE/CVSS, MITRE ATT&CK, network security, application security, and modern attack methodologies.
Experience working with development and infrastructure teams to provide remediation guidance and perform validation/retesting of security fixes.
Strong technical reporting skills, with the ability to communicate vulnerabilities, business impact, and remediation priorities to technical and leadership audiences.
Relevant certifications are preferred: OSCP, OSEP, OSWE, GPEN, GXPN, CRTO, or equivalent offensive security certifications.

Technologies

Burp Suite
Metasploit
Nmap
Kali Linux
Pentera
Pentera Console/Surface
Python
Bash
PowerShell
OWASP
CVE/CVSS
MITRE ATT&CK

Benefits

Medical/Dental/Vision/Life Insurance
Paid holidays plus Paid Time Off
401(k) plan and contributions
Long-term/Short-term Disability
Paid Parental Leave
Employee Stock Purchase Plan

Salary and other compensation

Annual salary: $134,000 - $154,500 per year, depending on experience and other qualifications.
Eligible for Cognizant’s discretionary annual incentive program, subject to plan terms and performance.

View full job page →

7d ago

Sr Applications Security Engineer

Fortinet Sunnyvale, CA

Sunnyvale, CA

7d ago

$147k - $180k/yr Full time Senior Application Security Application Security Engineering

Apply Now

Job Description

Fortinet’s Corporate Information Security team is hiring a Sr Applications Security Engineer in Sunnyvale, CA (onsite). This role centers on strengthening security across Fortinet applications by combining security reviews, vulnerability mitigation, and hands-on testing across the SDLC. You will help guide development teams, drive static and dynamic application security testing at scale, and contribute to coordinated handling of externally reported vulnerabilities.

What you’ll do

Act as an application security subject matter expert, providing guidance to internal teams
Collaborate with development teams to perform code reviews, penetration tests, and architectural reviews for existing code and new features
Develop, implement, and communicate vulnerability mitigation strategies to development teams
Support externally reported vulnerabilities as part of the Corporate Information Security Responsible Disclosure Program committee
Drive Fortinet’s static and dynamic application security testing program
Create strategies and evaluate solutions to design and implement tools, processes, and controls that support security and privacy in Fortinet applications
Advise teams on SDLC best practices
Proactively research new application attack vectors affecting Fortinet applications and infrastructure
Work within a global distributed team to share knowledge, manage workload, and coach peers in application security concepts and best practices

What you bring

5+ years of work experience as an Information Security Researcher or Engineer
3+ years manually auditing source code to find security issues, with programming skills in one or more of Java, .NET, Python, or JavaScript frameworks
Strong understanding of OWASP TOP 10 vulnerabilities
Strong understanding of common API security risks
Strong understanding of cloud-native application architecture, microservices, containerization, and secure deployment/implementation issues
Proven experience in application penetration testing, security code review, and application security testing using DAST, SAST, IAST, and SCA
Strong foundation in computer and network security, authentication & authorization, security protocols, and applied cryptography
Solid understanding of web security standards such as CSP, SOP, CORS, and emerging web security technologies
Solid understanding of CI/CD pipelines, build systems, and DevSecOps principles
Strong understanding of AI&ML and LLM concepts including RAG, Agentic Workflows, MCPs, Skills, AI Red Teaming, and AI Guardrails, plus secure AI development and deployment strategies
Experience defining security architecture patterns and standards in a large enterprise organization
Experience with cloud-based security solutions and familiarity with cloud service providers for application security
Experience with threat modeling methodologies such as MITRE ATT&CK, STRIDE, and PASTA
Understanding of OAuth and JWT implementations
Ability to organize and communicate effectively, written and verbal, with technical and non-technical stakeholders
BS degree in Computer Science, Cyber Security, other tech-related degree, or equivalent experience
Plus: Experience with Cloud Security Posture Management (CSPM) and/or Application Security Posture Management (ASPM) tools
Plus: OSWE, OSCP, GWEB, GPEN, or similar certificate
Plus: Experience in Mobile Application Penetration Testing

Compensation

USD 147,000 - 180,000 per year.

Benefits

Medical, dental, vision, life and disability insurance
401(k)
11 paid holidays
Vacation time
Sick time
Comprehensive leave program
Participation in the Fortinet equity program

View full job page →

8d ago

Application Security Engineer

Tempus Chicago, IL

Chicago, IL

8d ago

$85k - $130k/yr Full time Ai Enabled Security Ai Security Application Security

Apply Now

Job Description

Tempus is seeking an Application Security Engineer in Chicago, IL to help secure the software development lifecycle end-to-end. The role partners with product and engineering teams to assess applications and cloud-hosted services, strengthen SDLC controls, and address security risks in AI and LLM-enabled systems.

Key Responsibilities

Embed security into the SDLC through threat modeling, design reviews, security requirements, and security-focused code reviews with product and development teams.
Plan and conduct application security assessments and penetration tests for web applications, APIs, and cloud-hosted services, then document findings with clear risk ratings and practical remediation guidance.
Threat model and assess AI and LLM-enabled features, including agents, RAG pipelines, and tool or MCP integrations, using adversarial prompt testing and validating guardrails, permissions, and data access controls.
Select, integrate, and tune SAST, DAST, software composition analysis, and secrets scanning in CI/CD pipelines.
Build automation and secure-by-default patterns, including guardrails that prevent whole classes of vulnerabilities.
Use AI-assisted tooling to scale code review, triage, and remediation while applying human judgment to validate results.
Reproduce, triage, and prioritize application security vulnerabilities, and work with developers through remediation.
Communicate the nature, severity, and business risk of security issues to development teams and leadership.
Design, implement, and document application security controls, standards, and secure coding guidance.
Run and support the vulnerability disclosure program.
Coach developers on secure design and coding through consulting, training, and day-to-day collaboration.

Required Qualifications

3 to 5 years of experience in application security, penetration testing, or software engineering with a security focus.
Hands-on experience testing web applications, APIs, and cloud-hosted services using proxying and penetration testing tools such as Burp Suite, with strong knowledge of common security flaws and mitigations (including OWASP Top 10).
Experience performing security design reviews at the architecture level.
Working experience securing AI and LLM-enabled applications, including how they are designed and how they fail (prompt injection, data leakage, excessive agency, insecure output handling), informed by OWASP Top 10 for LLM Applications.
Practical experience using at least one threat modeling method, such as STRIDE, PASTA, or attack trees.
Experience with SAST, DAST, and SCA tools, including integrating them into CI/CD pipelines.
Proficiency in Python, Go, or JavaScript for security tooling and automation, with the ability to read and review code.
Solid understanding of network and web protocols (TCP/IP, HTTP/S), authentication and authorization (such as OAuth/OIDC), and cryptography fundamentals.
Ability to collaborate effectively with software development teams and Product Managers.
Excellent written and verbal communication skills, including clear explanation of complex topics.

Technologies

Burp Suite, OWASP Top 10
Python, Go, JavaScript
TCP/IP, HTTP/S
OAuth/OIDC
SAST, DAST, SCA, software composition analysis, secrets scanning
CI/CD
STRIDE, PASTA
OWASP Top 10 for LLM Applications
MCP, RAG pipelines

Bonus Qualifications

Hands-on AI red teaming or security testing of agentic or RAG systems, familiarity with MITRE ATLAS or the NIST AI Risk Management Framework.
Experience with Docker, Kubernetes, GCP, or AWS, and infrastructure-as-code scanning.
Bug bounty or vulnerability disclosure program experience.
Experience with HIPAA and healthcare data protection.
Interest in working in biotech, genomics, and precision medicine.
Certifications such as GWAPT, OSCP, CSSLP, CISSP, or ISC2 CC (Certified in Cybersecurity).

Location and Compensation

Location: Chicago, IL (onsite)
Salary: USD 85,000 to 130,000 per year
Experience: Minimum 3 years

View full job page →

11d ago

Application Security Engineer

Resolution Technologies Atlanta, GA

Atlanta, GA

11d ago

Full time Application Security Application Security Engineering Application Security Testing

Apply Now

Job Description

Resolution Technologies is hiring an Application Security Engineer to strengthen application security across Salesforce, .NET, and Azure App Services. This hybrid role is based in Atlanta, GA and centers on building secure SDLC practices, running security testing, and embedding security tooling into CI/CD workflows aligned to NIST controls.

You will be responsible for evaluating application security at both the code and platform levels, including Salesforce security configuration and the way modern development pipelines apply automated analysis. Work will involve threat modeling, risk assessment, penetration testing, and ongoing DevSecOps tool tuning to maintain measurable security coverage.

Responsibilities

Review Apex code, Visualforce pages, and Lightning components for security vulnerabilities.
Ensure correct Salesforce security configuration, including profiles, permission sets, role hierarchies, and sharing rules.
Implement and monitor field-level security, object-level access, and record-level access controls.
Validate secure integration patterns for external APIs and third-party apps within Salesforce.
Enforce OAuth scopes, connected app policies, and IP restrictions.
Conduct security health checks and Salesforce Shield audits.
Align Salesforce security architecture with NIST 800-53 and NIST CSF controls.
Collaborate with development teams to integrate security best practices into the SDLC.
Perform secure code reviews across Salesforce, .NET, and Azure-based applications.
Design and review application architecture to ensure alignment with NIST controls.
Perform threat modeling and risk assessments for new and existing applications.
Maintain and enhance security integrations with Git, Azure DevOps, and other version control systems.
Perform manual and automated penetration testing of web applications and APIs.
Identify and remediate vulnerabilities in Salesforce customizations, .NET codebases, and Azure-hosted services.
Own configuration, tuning, and maintenance for DevSecOps tools such as SonarQube, Checkmarx, Veracode, and Fortify.
Monitor and report on security tool performance and coverage.
Map application security controls to NIST standards and support audit readiness.
Document security requirements and ensure traceability to NIST control families.
Partner with engineering, QA, and operations teams to drive security awareness and training.
Provide guidance on secure coding standards and remediation strategies.
Support incident response related to application vulnerabilities.
Contribute to risk assessments and mitigation planning for both new and existing applications.

Requirements

Bachelor degree in Computer Science, Information Security, or related field (or equivalent experience).
7+ years of experience in application security, DevSecOps, or related roles.
Strong understanding of secure coding practices in .NET and Apex (Salesforce).
Experience with Salesforce security architecture and Azure App Services.
Proficiency in CI/CD pipelines and integrating security tools into Git and Azure DevOps workflows.
Familiarity with NIST 800-53, NIST CSF, and other cybersecurity frameworks.
Hands-on experience with SAST, DAST, SCA, and container security tools.
Strong scripting skills (e.g., PowerShell, Python, Bash) for automation.

Technologies

Salesforce, Apex, Visualforce, Lightning components
OAuth, Salesforce Shield
NIST 800-53, NIST CSF
DevSecOps, SDLC
Git, Azure DevOps
SonarQube, Checkmarx, Veracode, Fortify
SAST, DAST, SCA, container security tools
PowerShell, Python, Bash
.NET, Azure App Services

Preferred Qualifications

Certifications such as OSCP, GWAPT, CSSLP, or Salesforce Security Specialist.

View full job page →

13d ago

Lead Application Security Engineer

Tiro Security Pasadena, CA

Pasadena, CA

13d ago

$120k - $180k/yr Full time Api Security Application Security Application Security Engineering

Apply Now

Job Description

Join Tiro Security as a hands-on Lead Application Security Engineer in Pasadena, CA (onsite). This role strengthens DevSecOps and software assurance for an established financial services organization, with a focus on securing development pipelines and evaluating the trustworthiness of both internal and third-party applications. The compensation range is $120,000–$180,000 base per year.

What you’ll do

Secure development pipelines by assessing the trustworthiness of internally developed and third-party applications.
Coordinate penetration testing and support security outcomes with API security assessments.
Use threat intelligence to inform software risk decisions.

How you’ll deliver impact

Work closely with engineering teams to influence how software is developed, assessed, and approved for enterprise use. The scope combines pipeline security with deeper application analysis and continuous validation of application trust, including ongoing evaluation of risk based on technical findings.

Requirements

Proven application security or DevSecOps experience, including secure SDLC, threat modeling, and vulnerability remediation.
Hands-on experience with GitHub Advanced Security, including secret scanning, push protection, and security automation within CI/CD pipelines.
Practical SAST, DAST, and code-review experience, with tools such as CodeQL, Dependabot, and OWASP ZAP.
Experience assessing third-party software, dependencies, or compiled binaries, including knowledge of software supply chain security.