Automated Security Testing

Automated Security Testing Engineer Jobs

18 jobs found

Today

Application Security Engineer

Truist Bank Raleigh, NC

Raleigh, NC

Today

Full time Application Security Application Security Engineering Application Security Testing

Apply Now

Job Description

Truist Bank is seeking an Application Security Engineer in Raleigh, NC (onsite) to advance Dynamic Application Security Testing (DAST) capabilities across complex web applications and APIs.

Responsibilities

Design, configure, test, and continuously improve advanced DAST solutions and technical patterns for complex web applications and APIs
Perform and validate authenticated assessments, including login success, session state, crawl coverage, attack surface coverage, vulnerability results, and overall assessment validity
Engineer DAST scan policies, authentication workflows, login sequences, session handling, API definitions, custom scripts, integrations, and automation to support reliable and repeatable testing
Investigate complex or undefined assessment challenges such as multifactor authentication constraints, incomplete crawling, blocked requests, dynamic application behavior, tool limitations, false positives, false negatives, and inconsistent results
Use browser, proxy, HTTP, API, and logging/diagnostic techniques to identify root causes and implement practical reusable technical solutions
Analyze and document DAST evidence to separate validated vulnerabilities from suspected false positives, coverage limitations, and inconclusive findings; support remediation verification
Partner with application and engineering teams to understand runtime behavior, resolve testability constraints, and establish technically appropriate DAST configurations
Serve as a technical escalation point by reviewing complex configurations and technical evidence; share specialized knowledge through peer reviews, troubleshooting sessions, and reusable documentation

Requirements

Bachelor’s degree (or equivalent education, training, and work-related experience)
Minimum 5 years of experience in security engineering or related cybersecurity roles
Advanced knowledge of cybersecurity principles, theories, and concepts
Proven experience applying security practices across the software development lifecycle
Advanced knowledge of threat modeling, security testing, and penetration testing
Experience implementing and managing complex information security technologies

Technologies

DAST
HTTP
API
Browser
Proxy
Logging

Preferred Qualifications

Advanced cybersecurity certification such as CISSP, CSSLP, GIAC, GWAPT, OSWE, or an equivalent application security credential
Deep hands-on experience with enterprise DAST technologies and methodologies for complex web applications and APIs
Advanced experience with authenticated testing, modern authentication protocols, session management, multifactor authentication, scripted login workflows, and credential handling
Deep working knowledge of HTTP, browser behavior, web and API architectures, authentication and authorization patterns, API specifications, and common application frameworks
Experience with security automation, APIs, scripting, data transformation, orchestration, CI/CD integrations, or workflow technologies
Familiarity with emerging cybersecurity technologies, industry trends, and strategic risk management

Benefits

Medical, dental, vision
Life insurance
Disability
Accidental death and dismemberment
Tax-preferred savings accounts
401k plan
No less than 10 days of vacation (prorated based on date of hire and by full-time or part-time status) during the first year of employment
10 sick days (prorated)
Paid holidays
May be eligible for Truist’s defined benefit pension plan (depending on the position and division)
May be eligible for restricted stock units (depending on the position and division)
May be eligible for a deferred compensation plan (depending on the position and division)

Additional Information

Language fluency: English (Required)
Work shift: 1st shift (United States of America)
Regular or temporary: Regular

View full job page →

3d ago

Sr. Principal/ Principal Product Security Engineer

Northrop Grumman Dulles, VA

Dulles, VA

3d ago

$125k - $235k/yr Full time Senior Automated Security Testing Embedded Software Security

Apply Now

Job Description

Embed security throughout the mission lifecycle while supporting spacecraft and flight software that require authorization to operate. Northrop Grumman is seeking a Sr. Principal/Principal Product Security Engineer (TS/SCI) to partner with engineering, systems, and cybersecurity teams, develop RMF deliverables, integrate security tooling into CI/CD, and support the ATO process. This 100% onsite role is based in Dulles, VA.

Compensation: USD 125,300 - 234,600 per year (with level-based salary ranges). Travel: Yes, 10% of the time.

Responsibilities

Collaborate with engineering, program, systems, and cybersecurity stakeholders to review and strengthen product-security processes across development, testing, governance, and authorization activities.
Act as a hands-on product security partner to embedded software, DevOps, and ground or supporting software teams throughout the software development lifecycle.
Advise software teams on secure coding practices, secure architecture, embedded system security design, software supply-chain security, and CI/CD pipeline security.
Perform security assessments of embedded and mission software, including architecture reviews, code reviews, vulnerability assessments, attack surface analyses, and security testing.
Develop and maintain threat models and security analyses for embedded software and supporting platforms, including data-flow diagrams, trust-boundary analyses, misuse or abuse cases, and risk assessments.
Integrate, operate, and improve security tooling within GitLab CI, Jenkins, or equivalent CI/CD platforms, including SAST, SCA, secret scanning, SBOM generation, infrastructure and configuration scanning, and custom security checks.
Contribute to security tool development and automation using Python, Go, or similar languages to improve engineering velocity and visibility while supporting assurance evidence collection.
Triage and validate security findings, then collaborate with engineering and technical leadership to evaluate risk, set remediation priorities, and drive findings to closure.
Support secure management of third-party, open-source, and internally developed components through dependency risk assessments, SBOM review, vulnerability management, and related supply-chain security activities.
Develop standard RMF artifacts including System Security Plans (SSPs), Risk Assessment Reports (RARs), Security Controls Traceability Matrices (SCTMs), Plans of Action and Milestones (POA&Ms), and supporting control implementation narratives and security policies.
Support system authorization for Platform IT (PIT) systems and work with system owners, ISSMs/ISSOs, and security control assessors to obtain an Authorization to Operate (ATO).
Translate security risks and technical findings into clear, actionable guidance for engineers, program leadership, and nontechnical stakeholders.
Mentor software and security engineers on secure development practices and help establish scalable product security standards across the organization.

Requirements

Active Top Secret/SCI security clearance at the time of application.
Education and experience: lvl 3 requires 8+ years experience depending on degree level (Bachelor’s 3 years, Master’s 3 years with 3 years additional experience as specified, or PhD with 1 year as specified per level). lvl 4 requires at least 8 years experience depending on degree level (with Bachelor’s, Master’s, or PhD equivalents as specified).
Proficiency in C or C++ and experience reviewing, developing, or securing embedded software.
Experience with Python, Go, or a similar language to build automations, integrations, or custom tooling.
Experience with RTOS, embedded Linux, or comparable embedded system platforms.
Experience developing or performing security testing for embedded systems and/or C/C++ applications.
Knowledge of secure software development lifecycle practices, including requirements, architecture, implementation, test, release, and vulnerability management.
Experience analyzing security vulnerabilities and partnering with software engineers to prioritize and remediate findings.
Strong problem-solving, troubleshooting, written communication, and technical collaboration skills.
Familiarity with system authorization for achieving an ATO for PIT systems and experience conducting system security assessments.

Technologies

C, C++, Python, Go
GitLab CI, Jenkins, CI/CD, Git, Subversion
SAST, SCA, SBOM
RTOS, embedded Linux
CISSP, CISSP-ISSEP, CSSLP
Security+, CWE, CVE, CVSS, GHSA, CISA KEV
NIST RMF, NIST SP 800-53, NIST SP 800-160, NIST SP 800-218

Benefits

Relocation assistance may be available.
Depending on the position, eligibility for overtime, shift differential, and a discretionary bonus in addition to base pay.
Annual bonuses designed to reward individual contributions and share in company results.
Long Term Incentives may be available for employees in Vice President or Director positions.
Health insurance coverage.
Life and disability insurance.
Savings plan.
Company paid holidays.
Paid time off (PTO) for vacation and/or personal business.

Clearance required to start: Yes (Top Secret). Role setup: 100% onsite in Dulles, Virginia. Application period: estimated 20 days from the job posting date.

View full job page →

3d ago

Cybersecurity Engineer (Application Security)

TECHNOLOGY & INNOVATION Brooklyn, NY

Brooklyn, NY

3d ago

$75k - $95k/yr Full time Application Security Application Security Testing Automated Security Testing

Apply Now

Job Description

Join a mission-driven environment in Brooklyn, NY where you’ll help strengthen software security across the City of New York. In this Application Security focused role, you’ll support the Software Security Assurance Program (SSAP) by finding vulnerabilities early, improving secure development workflows, and guiding teams with clear, actionable guidance.

Salary range: $75,000 to $95,000 per year. Location: Brooklyn, NY (onsite). Experience: 4+ years. Education: baccalaureate degree.

What you will do

Help run the daily Software Security Assurance Program (SSAP) to support security standards before applications are deployed.
Support SAST and DAST security testing to identify vulnerabilities across citywide applications.
Use Software Composition Analysis (SCA) tools to identify, track, and report vulnerabilities in open-source and third-party components.
Act as a bridge between developers and security teams to integrate security requirements into development workflows.
Complete foundational security reviews of cloud vendor applications to validate alignment with city security guidelines.
Contribute guidance and training materials for development teams based on established secure coding standards and OWASP guidance.
Assist with updates and maintenance for security documentation, guidelines, and compliance tracking frameworks (including NIST, CIS, OWASP).
Stay current on emerging cybersecurity threats and participate in team mentorship to grow application security expertise.
Take on special projects and initiatives as assigned.

What you bring

A baccalaureate degree from an accredited college and four years of satisfactory full-time experience related to the projects and policies required for the position; or equivalent education and/or experience.
Hands-on exposure to standard SAST, DAST, and/or SCA tools and basic vulnerability assessment techniques. Examples include Veracode, Checkmarx, Snyk, and Burp Suite.
Familiarity with OWASP Top 10, secure coding concepts, and common development languages such as Python, Java, and JavaScript.
Understanding of core cloud concepts (AWS, Azure, or GCP) and common web API security practices (OAuth, REST).
Understanding of municipal government operations, including the ability to communicate technical security risks to diverse agency stakeholders.
Active pursuit or completion of entry-level security certifications such as CompTIA Security+, eJPT, or GIAC GSEC.

Tools and standards you will use

SAST, DAST, SCA (Veracode, Checkmarx, Snyk, Burp Suite), OWASP Top 10, and guidance aligned to NIST and CIS, including OWASP. Development and security concepts include Python, Java, JavaScript, AWS, Azure, GCP, OAuth, and REST, plus relevant certifications such as CompTIA Security+, eJPT, and GIAC GSEC.

Schedule

Daytime work is typical, but due to technical duties in a 24/7 operation, candidates may be required to work various shifts, including weekends and/or nights/evenings.

Additional details

Public service loan forgiveness: As a prospective City of New York employee, you may be eligible for federal loan forgiveness and state repayment assistance programs.
Residency: New York City residency is not required.
How to apply: Interested applicants with other civil service titles who meet the preferred requirements should submit a resume for consideration.

View full job page →

5d ago

Cybersecurity Engineer III

Teladoc Health New York, NY 🇺🇸 Remote

New York, NY

5d ago

$149k - $171k/yr Full time Application Security Application Security Testing Automated Security Testing

Apply Now

Job Description

Teladoc Health is seeking a Cybersecurity Engineer III to help strengthen application security and DevSecOps across its development lifecycle. This role focuses on bringing SAST, SCA, and secrets scanning into development workflows, while also supporting endpoint security through EDR alert monitoring and improving the security posture of a medical device fleet.

Working with partner teams, you will translate security findings into engineering guidance, help automate security checks, and contribute to security controls and compliance documentation tied to safety standards.

Responsibilities

Advance Application Security (AppSec) by integrating Static Application Security Testing (SAST), Software Composition Analysis (SCA), and secrets scanning tools into development workflows.
Support DevSecOps by writing basic scripts to automate security checks and monitoring vulnerabilities within the SDLC.
Maintain endpoint security by monitoring EDR (Endpoint Detection and Response) alerts and ensuring application controls and threat detection are correctly applied across Teladoc Health’s medical device fleet.
Enhance Medical Device Security by assisting with risk assessments, supporting the enforcement of security controls, and contributing to documentation of compliance with safety standards.

Requirements

Bachelor’s degree (or foreign equivalent) in Computer Science, Information Technology, Electrical Engineering, Cybersecurity, Computer Engineering, or a related field.
4 years of experience as a Cybersecurity Engineer, Security Analyst, or in an occupation involving application security and medical device security within the Healthcare Industry.
Employment experience translating security findings into actionable engineering guidance.
Experience working across partner teams, including DevOps and application teams, to define and implement security-related solutions.
Ability to provide clear documentation for the design and implementation of security-related controls and processes.
Experience with related security platforms, including AppSec, DevSecOps, and EDR.
Experience applying security controls within medical device systems.

Technologies

Static Application Security Testing (SAST)
Software Composition Analysis (SCA)
Secrets scanning tools
EDR (Endpoint Detection and Response)
AppSec
DevSecOps
SDLC

Location

New York, NY (remote)

Compensation

USD 149,011 - 170,900 per year

Benefits

Flexible Vacation Policy (all time off must be approved by your manager prior to use)
80 hours of Paid Sick, Safe, and Caregiver Leave annually (full-time positions only)

View full job page →

6d ago

Sr. Application Security Engineer

Extra Space Management, Inc Salt Lake City, UT

Salt Lake City, UT

6d ago

Full time Senior Ai Security Application Security

Apply Now

Job Description

Sr. Application Security Engineer role in Salt Lake City, UT (hybrid), embedded with product and engineering teams to strengthen security across the software delivery lifecycle.

Responsibilities

Lead security architecture and design reviews for new and evolving features, identifying risk early and proposing practical mitigations
Run threat modeling and perform manual and automated code reviews, partnering with developers to prioritize and remediate findings
Apply a risk-based approach to application security, explaining vulnerabilities in terms of business impact
Help mature Secure SDLC with secure coding standards, security requirements, and automated checks in CI/CD pipelines, including SAST, DAST, SCA, and secrets scanning
Build and maintain security tooling and automation that scales across teams, focused on reducing risk
Own and grow the security champions program, training champions so security expertise is available within each team
Serve as an application security subject matter expert for engineering, product, and leadership; mentor engineers on secure development practices
Ensure AI tools and AI-powered features are adopted within acceptable risk limits
Align applications with SOC 1, SOX, CIS v8, and PCI DSS (including SAQ-A and SAQ-P2PE); support audits with evidence and remediation plans

Requirements

6+ years combined experience in software engineering, application security, product security, or a closely related field
Proficiency in primary languages: C# .NET, TypeScript, JavaScript, SQL
Experience securing web applications using modern frameworks and cloud-native architectures, with emphasis on AWS
Hands-on white-box testing and secure code review experience
Strong understanding of SSDLC principles, including implementing or maturing secure development programs
Working knowledge of common vulnerabilities and attack techniques, including OWASP Top 10, API security, and authentication/authorization flaws
Experience integrating security tooling into delivery pipelines using GitHub, TeamCity, or similar
Familiarity with AI security risks and emerging attack surfaces, including agentic systems, MCP, and LLM-powered workflows
Risk-focused mindset: translate security risk into business terms, weigh against risk tolerance and needs, and support pragmatic decisions without security theater
Demonstrated ability to build trusted relationships with engineering teams and influence behavior without direct authority
Strong written and verbal communication, comfortable in both design reviews and leadership risk discussions

Technologies

AWS, Vercel, C# .NET, TypeScript, JavaScript, React/Next.js, SQL Server, SQL
SAST, DAST, SCA, secrets scanning, CI/CD, GitHub, TeamCity
SOC 1, SOX, CIS v8, PCI DSS, SAQ-A, SAQ-P2PE
OWASP Top 10, API security, SSDLC
Agentic systems, MCP, LLM-powered workflows
Secure coding standards

Preferred Qualifications

Development experience with Next.js, Vercel, or serverless architectures
Practical knowledge of security frameworks and standards such as OWASP ASVS, NIST 800-53, CIS v8, PCI DSS, or SOX
Hands-on security certifications such as OSCP, BSCP, GWEB, PNPT, or similar
Experience running or triaging a bug bounty program
Bachelor’s degree in Computer Science, Information Security, or a related field

Work Environment & Physical Requirements

Sedentary work in an office environment; limited lifting (less than 10 pounds) or walking required
Close visual acuity required to perform work at a computer terminal
No exposure to adverse environmental conditions
Requires repetitive typing motion, talking, hearing, grasping, and feeling

Applications deadline: Applications will be accepted until the position is filled.

View full job page →

7d ago

Engineer, Application Security

Intercontinental Exchange Holdings, Inc. Jacksonville, FL

Jacksonville, FL

7d ago

Full time Application Security Application Security Testing Automated Security Testing

Apply Now

Job Description

Intercontinental Exchange Holdings, Inc. (ICE) is seeking an Application Security Engineer to help ensure ICE produces and maintains secure applications. This Jacksonville, FL (onsite) role blends practical security testing with engineering-minded guidance, supporting developers from early design through automated and hands-on validation.

What you’ll do

You will operate the Application Development Security Lifecycle, spanning design review through automated and hands-on testing. You will also help shape how security is applied across projects by maintaining and contributing to Application Development Security Policies and standards, staying current with industry trends and publications from NIST, OWASP, and SANS.

Security will be embedded early in the software process. You will work with development teams to set security requirements during the SDLC and provide security subject matter expertise for new projects and releases.

Automation and modern tooling are central to the role. You will implement, maintain, and integrate technologies that assess application security, including SAST (static code analyzers), DAST (dynamic testing), software composition scanners, Web Application Firewall (WAF) capabilities, and bug bounty programs. You will also focus on keeping developers informed on secure coding practices.

To strengthen adoption across ICE, you will build rapport with the application development community through training sessions, one-on-one education, Intranet blogs, and other learning opportunities, while communicating security findings to developers, QA teams, and management.

Qualifications

University degree in Computer Science, Engineering, MIS, CIS, or a related discipline
Software engineering experience with Java, C++, .NET and/or related languages
Expertise deploying, configuring, and using SAST, DAST, and Software Composition in large environments
Experience designing solutions that integrate transparently with the CI/CD pipeline
Familiarity with application development in large cloud environments
Interest in or exposure to AI and large language models (LLMs), including emerging security risks such as prompt injection (plus)

How you’ll grow (scope and seniority expectations)

Document and publish technology guidance and repeatable processes
Mentor peers in groups and individually
Improve processes and introduce superior technology
Take initiative to learn business goals, liaise with other departments, and identify ways to increase productivity in other ICE groups and offices

View full job page →

7d ago

Application Security Engineer Senior

Starbucks Nashville, TN

Nashville, TN

7d ago

$112k - $187k/yr Full time Senior Application Security Automated Security Testing

Apply Now

Job Description

Starbucks is seeking a Senior Application Security Engineer in Nashville, TN (onsite) to develop and execute Application Security Engineering Program practices. This role delivers security guidance and performs assessments to help ensure technology platforms align with established standards and policies.

Key Responsibilities

Own application security services, including SAST, DAST, SCA, penetration testing, bug bounty, and code review.
Build and improve application security services, using new approaches and AI-driven capabilities when they can improve speed, accuracy, and scale.
Support threat remediation by partnering with other cybersecurity teams and providing expert analysis and context.
Apply deep expertise in source code management platforms and CI/CD workflows, including GitHub Enterprise, GitHub Cloud, GitLab, and Azure Devops, with a strong understanding of secure cloud deployment workflows.
Provide hands-on guidance for OWASP Top 10 and SANS Top 25 issues, including explaining and correcting findings.
Evaluate analysis produced by AI for accuracy, risk relevance, and remediation quality, ensuring validation before using results to guide decisions.
Recommend improvements to toolsets, development processes, and production application security support.
Contribute to the development and delivery of security training programs.
Participate as a key member in security incident response activities.

Required Qualifications

Bachelor’s degree in a relevant field, or 5+ years of equivalent experience in cybersecurity engineering related roles.
6+ years of experience in an information technology discipline.
6+ years of infrastructure or information security experience.
4+ years of experience working with infrastructure as code technologies.
Experience deploying, configuring, and troubleshooting cybersecurity tools in enterprise environments.
Certifications such as CISSP, CISSM or others focused on cybersecurity, data privacy, or information risk management.
Advanced knowledge of cybersecurity principles and practices.
Experience with firewalls, antivirus software, and intrusion detection systems.
Experience with security frameworks and compliance requirements.
Proficiency in implementing and managing security controls and technologies.
Knowledge of network security protocols and concepts.
Familiarity with operating systems and network architectures.
In-depth understanding of enterprise-level cybersecurity strategies, frameworks, and technologies.
Proficiency conducting security assessments and audits.
Ability to develop and implement security policies and procedures.
Experience managing and responding to security incidents.
Exceptional problem-solving and troubleshooting skills.
Excellent communication and collaboration skills across cross-functional teams and stakeholders.
Advanced experience with at least one modern programming language: Java, Go, Python, Ruby, C++, or C#.
Advanced proficiency interacting with API’s and automating tasks using common scripting languages.
Ability to apply multidisciplinary business principles to achieve successful outcomes in cross-functional projects.
Proficiency with Microsoft Word, Excel, and PowerPoint.
Ability to work effectively within large collaborative organizations.
Knowledge and ability to apply process improvement principles.
Strong written, verbal, and active listening skills.
Ability to model and act in accordance with Starbucks guiding principles.
Capability to foster effectiveness during changes in tasks, work environment, or organizational conditions.
Strong analytical and problem-solving skills, with the ability to balance multiple priorities and meet deadlines.

Preferred Qualifications

Development expertise in 2 or more of: Python, JavaScript, C#, Java, Scala, Objective-C, Swift, Kotlin.
Understanding of PCI practices and experience working with PCI environments.
Experience working with cloud platforms such as AWS and Azure from both a developer and security perspective.
Experience working with Bug Bounty or VDP programs.
Certifications such as CEH, CSSLP, CISSP, GIAC (GWAPT, GMOB, etc.).
Strong communication and relationship-building skills.
Experience performing security-focused application design reviews and static and manual code reviews.
Experience using common security testing tools and techniques across multiple platforms, with significant expertise in either web or mobile penetration testing.
Experience implementing and operating static and dynamic analysis tools.
Strong understanding of authentication and authorization options and standards.
Deep knowledge of security vulnerabilities, including the ability to identify them, assess risk, and provide remediation guidance.
Experience working as a software engineer and familiarity with modern web, mobile, and API development practices.
Ability to read and write code in multiple programming languages.
Experience with Git and GitHub.
Knowledge of CI/CD practices.
Experience incorporating security requirements into a SDLC.

Technologies

SAST
DAST
SCA
GitHub Enterprise
GitHub Cloud
GitLab
Azure Devops
OWASP Top 10
SANS Top 25
CISSP, CISSM
Firewalls, antivirus software, intrusion detection systems
Infrastructure as code technologies
Java, Go, Python, Ruby, C++, C#
API’s

Compensation and Location

Location: Nashville, TN (onsite)
Salary: USD 112,400 - 187,400 per year
Minimum experience: 5 years

Benefits

Medical, dental, vision
Basic and supplemental life insurance
Other voluntary insurance benefits
Short-term and long-term disability
Paid parental leave
Family expansion reimbursement
Paid vacation from date of hire
Sick time (accrued at 1 hour for every 25 hours worked)
Eight paid holidays
Two personal days per year
401(k) retirement plan with employer match (eligible partners)
Discounted company stock program (S.I.P.)
Starbucks equity program (Bean Stock)
Incentivized emergency savings
Financial well-being tools
100% upfront tuition coverage for a first-time bachelor’s degree through Arizona State University’s online program via the Starbucks College Achievement Plan
Student loan management resources
Access to other educational opportunities
Access to backup care and DACA reimbursement