Appsec Ci/cd

Appsec Ci/cd Engineer Jobs

2 jobs found

Today

Senior Software Engineer, Application Security

Box Redwood City, CA

Redwood City, CA

Today

$211k - $264k/yr Full time Application Security Appsec Ci/cd Cloud Platforms

Apply Now

Job Description

Box is seeking a Senior Software Engineer, Application Security to help build production-grade security services and automation that protect Box and its customers. In this hybrid role based in Redwood City, CA, you will design and deploy security controls that fit directly into Box product development and CI/CD workflows, spanning the SDLC from engineering guardrails to AI security protections.

You will work across end-to-end application and backend service development while partnering with Product and Engineering teams to turn complex security challenges into scalable software solutions.

What you’ll do

Design, build, and operate production-grade security services, features, and internal tools to protect Box and customers.
Engineer end-to-end applications and backend services with strong foundations in modern data stores, application frameworks, and scalable architectures.
Build systems and automation to detect, prevent, and mitigate security threats at scale.
Create “paved road” frameworks, libraries, and guardrails that make secure development seamless and standard for Box engineers.
Develop security automation and verification controls integrated into Box CI/CD pipelines.
Architect and implement AI security controls, evaluation frameworks, and automated protections across product verticals.
Partner closely with Product and Engineering teams to deliver elegant, scalable security software solutions.

What you bring

4+ years of professional software development experience in languages such as Java, Python, PHP, Go, or Scala.
Proven ability to build end-to-end applications, including experience with databases, modern frameworks, and API design.
Strong software engineering fundamentals across object-oriented and functional design, system architecture, automated testing, reliability, and code quality.
Foundational understanding of security concepts and a strong passion for solving security problems through software engineering (deep security specialization is not required).
Ability to break down complex technical problems into clean, scalable, maintainable systems.
Strong analytical and problem-solving skills, with excellent communication and cross-functional collaboration.
Bachelor’s degree in Computer Science, a related technical field, or equivalent practical experience.

Technologies you may work with

Java, Python, PHP, Go, Scala
Kafka, RabbitMQ, SQS
Java Spring, Spring Boot
AWS, GCP, Azure
Terraform

Preferred skills

Experience or familiarity with distributed systems, microservices architectures, or message queues (e.g., Kafka, RabbitMQ, SQS).
Experience with Java Spring / Spring Boot.
Familiarity with public cloud platforms (AWS, GCP, Azure) and Infrastructure as Code (e.g., Terraform).
Familiarity with AI/ML systems, LLMs, or AI application security.

Compensation: USD 211,000 - 263,500 per year.

View full job page →

6d ago

Sr Application Security Engineer

BJ's Wholesale Club, Inc. Marlborough, MA

Marlborough, MA

6d ago

$100k - $132k/yr Full time Senior Application Security Application Security Engineering

Apply Now

Job Description

BJ’s Wholesale Club, Inc. is hiring a Sr Application Security Engineer to help secure the software that powers BJ’s digital, e-commerce, and club-facing experiences. This individual contributor role partners with development teams to assess risk, improve secure delivery practices, and reduce security exposure across applications and APIs.

Based in Marlborough, MA with a hybrid schedule, the engineer will focus on threat modeling, operating and tuning the application security testing tool chain, and strengthening security controls in CI/CD and the software development lifecycle.

Location and Schedule

Marlborough, MA (hybrid)
Tuesday to Thursday: in-office at BJ’s Club Support Center
Monday and Friday: remote

Compensation

USD 100,000 - 131,500 per year

Responsibilities

Conduct threat modeling and security reviews for new and existing applications, APIs, microservices, and third-party integrations across customer-facing and internal platforms.
Operate and tune the application security testing tool chain, including SAST, DAST, SCA and dependency analysis, secrets detection, infrastructure-as-code scanning, and container image scanning, with goals to onboard applications, expand coverage, and reduce false positives.
Partner with development teams to remediate security defects and provide recommendations for secure coding practices and fixes.
Implement and maintain security controls in CI/CD pipelines, including policy-as-code and automated testing capabilities for secure software delivery.
Drive Secure SDLC improvements aligned to OWASP SAMM, BSIMM, and NIST SSDF, including maturity assessments and closing assigned gaps.
Collaborate with embedded and co-sourced team members to support application security activities and promote consistent practices.
Support API security across discovery and inventory, schema and specification validation, and identifying shadow and zombie APIs.
Develop and maintain secure coding guidance and reusable security resources for development teams, including developer security awareness and security champions initiatives.
Support PCI DSS 4.0.1 application requirements, including secure development practices, change control, client-side script integrity and monitoring for payment pages, and evidence collection for audits.
Support penetration testing and responsible disclosure workflows, including scoping input, findings validation, retesting, and root cause analysis to prevent recurrence.
Automate security testing tasks and evidence collection through integrations across security tooling, source control, and Jira.
Perform software supply chain security reviews, including open-source governance, SBOM generation and review, and evaluation of third-party and SaaS applications.
Support incident response for application-layer events, including exploit reproduction, root cause analysis, and recommended control improvements.
Write and maintain application security documentation such as runbooks and standard operating procedures.
Produce metrics and reporting for scanning coverage, Secure SDLC adoption, and security posture across the application portfolio.

Requirements

Bachelor’s degree in Computer Science, Information Security, or equivalent practical experience.
4-6 years of hands-on security or software engineering experience, with at least 2 years focused on application or product security.
Working knowledge of at least one modern programming language: Java, C#/.NET, JavaScript/TypeScript, Python, or Go, including ability to read application code and recognize vulnerable patterns.
Working knowledge of OWASP Top 10, OWASP API Security Top 10, and OWASP ASVS, including ability to explain exploitability and the correct fix to developers.
Hands-on experience operating enterprise SAST, DAST, and SCA tooling, including onboarding applications and tuning rulesets.
Experience participating in threat modeling using STRIDE or a comparable methodology, translating findings into actionable security requirements.
Experience integrating security testing into CI/CD pipelines.
Experience securing cloud-native applications in AWS, Azure, and/or GCP, including containerized workloads (Docker required, Kubernetes preferred).
Hands-on scripting and automation experience with Python, Bash, or PowerShell.
Familiarity with security frameworks and compliance requirements as they apply to software development, including PCI DSS, NIST SSDF, OWASP SAMM, BSIMM, CIS, or ISO 27001.
Ability to work independently, manage competing priorities, and make sound technical decisions with limited day-to-day oversight.
Strong communication skills and ability to work effectively with engineering teams.

Technologies

Java; C#/.NET; JavaScript/TypeScript; Python; Go
OWASP Top 10; OWASP API Security Top 10; OWASP ASVS
SAST; DAST; SCA; dependency analysis; secrets detection; infrastructure-as-code scanning; container image scanning
CI/CD; policy-as-code
OWASP SAMM; BSIMM; NIST SSDF; PCI DSS 4.0.1
STRIDE; Docker; Kubernetes
AWS; Azure; GCP
Bash; PowerShell
SBOM; SBOM generation; Jira; source control
SLSA; Terraform; CloudFormation

Benefits

Weekly Pay
Daily Pay
Free BJ’s Memberships
Generous Paid Time Off
Flexible and Affordable Health Benefits
401(k) Retirement Savings Plan
Employee Stock Purchase Plan

Nice to Have

Experience in retail, e-commerce, or other high-volume PCI in-scope environments.
Experience with API security platforms and discovery tooling.
Experience working within an embedded, co-sourced, or managed application security delivery model alongside external partners.
Experience contributing to a security champions program.
Experience supporting bug bounty or responsible disclosure programs.
Offensive security or exploit development background, including CTF or hands-on web application exploitation experience.
Familiarity with infrastructure-as-code such as Terraform or CloudFormation.
Familiarity with software supply chain security practices such as SBOM, SLSA, and artifact signing.
Familiarity with securing AI-assisted development workflows and LLM-integrated applications, including the OWASP Top 10 for LLM Applications.

Preferred Certifications

CompTIA Security+
GIAC GWAPT, GWEB, or (ISC)² CSSLP
AWS or Azure Security certifications
OSCP or OSWE
CCSP

View full job page →

Appsec Ci/cd Engineer Jobs

Senior Software Engineer, Application Security

Sr Application Security Engineer

Get Appsec Ci/cd Engineer Jobs alerts