Application Security Engineer

Purpose Brands is hiring an Application Security Engineer to expand application security capabilities within a DevSecOps delivery model.

Responsibilities

• Embed application security practices across the full SDLC, covering design, deployment, and ongoing maintenance
• Run application security assessments using SAST, DAST, and SCA
• Develop and maintain threat models for critical applications and systems, working with engineering teams to identify threats, evaluate risk, and drive remediation
• Advance secure coding practices and contribute to secure development standards aligned with OWASP and industry best practices
• Collaborate with engineering and DevOps teams to integrate security tooling into CI/CD pipelines for automated, repeatable security testing
• Review and manage vulnerability results from tools such as GitHub Advanced Security, Syft, Clair, Qualys, and similar platforms
• Tune security tooling to reduce false positives and improve signal quality for development teams
• Support security automation adoption to improve consistency, efficiency, and scalability across application environments
• Help secure applications deployed on AWS and Azure, including workloads on IaaS, PaaS, and container-based platforms
• Identify and assess risks to confidentiality, integrity, and availability of application data in cloud environments
• Partner with cloud and platform security engineers to align application security controls with broader cloud security architecture
• Own and curate security controls within Cloud Engineering and Platform Engineering spaces, aligned to NIST CSF, CIS Benchmarks, and CSA CCM
• Triage, prioritize, and track vulnerability remediation based on risk and business impact
• Assist with security investigations tied to application vulnerabilities or security events
• Participate in periodic reviews of application security controls to validate effectiveness and compliance with organizational standards
• Serve as a security partner to engineering teams by providing guidance, education, and actionable recommendations
• Contribute to continuous improvement of application security processes, standards, and metrics
• Support governance, risk management, and compliance initiatives related to application security

Requirements

• Bachelor’s degree in Computer Science, Information Systems, Engineering, or a related field
• 3–5 years of experience in application security, security engineering, or software engineering with strong security focus
• Hands-on experience performing code reviews and application security testing across modern languages, frameworks, and APIs
• Experience with application security tooling including SAST, DAST, and dependency scanning (for example, GitHub Dependabot or similar)
• Strong knowledge of OWASP Top 10, secure coding principles, authentication/authorization, and API security
• Practical experience supporting applications running in AWS and/or Azure
• Familiarity with CI/CD, DevOps workflows, and DevSecOps concepts
• Ability to communicate security risk and remediation guidance clearly to developers and non-security stakeholders
• Strong analytical skills with the ability to balance security risk with delivery velocity

Technologies

• AWS, Azure, IaaS, PaaS, container-based platforms
• SAST, DAST, SCA
• GitHub Advanced Security, Syft, Clair, Qualys
• OWASP Top 10, OWASP, GitHub Dependabot
• CI/CD pipelines, DevOps, DevSecOps
• NIST CSF, CIS Benchmarks, CSA CCM

Benefits

• Medical, Dental and Vision Coverage
• Hybrid Work Environment
• Life and Disability Insurance
• Unlimited Time off + Paid Holidays
• Flexible Friday's between Memorial Day and Labor Day
• 401(K) Savings Plan Matching at 4%
• 10 Coaching and Therapy sessions
• Mental Health Benefits
• Brand Discounts & Reimbursements
• In-house workout facilities
• Professional Development Opportunities
• Team Building, Employee Engagement Activities & so much more

Preferred Certifications

• Security+, CSSLP, GWAPT, GWEB, CEH, GPEN or other application security-focused certifications

Work Schedule

• Hybrid work model for employees at Boca Raton (FL), Woodbury (MN), and Seattle (WA) offices
• Remote optional: Fridays
• On-site days: Mondays, Tuesdays, Wednesdays and Thursdays

Location: Boca Raton, FL (hybrid)