Application Security Engineer

Truist Bank is seeking an Application Security Engineer in Raleigh, NC (onsite) to advance Dynamic Application Security Testing (DAST) capabilities across complex web applications and APIs.

Responsibilities

• Design, configure, test, and continuously improve advanced DAST solutions and technical patterns for complex web applications and APIs
• Perform and validate authenticated assessments, including login success, session state, crawl coverage, attack surface coverage, vulnerability results, and overall assessment validity
• Engineer DAST scan policies, authentication workflows, login sequences, session handling, API definitions, custom scripts, integrations, and automation to support reliable and repeatable testing
• Investigate complex or undefined assessment challenges such as multifactor authentication constraints, incomplete crawling, blocked requests, dynamic application behavior, tool limitations, false positives, false negatives, and inconsistent results
• Use browser, proxy, HTTP, API, and logging/diagnostic techniques to identify root causes and implement practical reusable technical solutions
• Analyze and document DAST evidence to separate validated vulnerabilities from suspected false positives, coverage limitations, and inconclusive findings; support remediation verification
• Partner with application and engineering teams to understand runtime behavior, resolve testability constraints, and establish technically appropriate DAST configurations
• Serve as a technical escalation point by reviewing complex configurations and technical evidence; share specialized knowledge through peer reviews, troubleshooting sessions, and reusable documentation

Requirements

• Bachelor’s degree (or equivalent education, training, and work-related experience)
• Minimum 5 years of experience in security engineering or related cybersecurity roles
• Advanced knowledge of cybersecurity principles, theories, and concepts
• Proven experience applying security practices across the software development lifecycle
• Advanced knowledge of threat modeling, security testing, and penetration testing
• Experience implementing and managing complex information security technologies

Technologies

• DAST
• HTTP
• API
• Browser
• Proxy
• Logging

Preferred Qualifications

• Advanced cybersecurity certification such as CISSP, CSSLP, GIAC, GWAPT, OSWE, or an equivalent application security credential
• Deep hands-on experience with enterprise DAST technologies and methodologies for complex web applications and APIs
• Advanced experience with authenticated testing, modern authentication protocols, session management, multifactor authentication, scripted login workflows, and credential handling
• Deep working knowledge of HTTP, browser behavior, web and API architectures, authentication and authorization patterns, API specifications, and common application frameworks
• Experience with security automation, APIs, scripting, data transformation, orchestration, CI/CD integrations, or workflow technologies
• Familiarity with emerging cybersecurity technologies, industry trends, and strategic risk management

Benefits

• Medical, dental, vision
• Life insurance
• Disability
• Accidental death and dismemberment
• Tax-preferred savings accounts
• 401k plan
• No less than 10 days of vacation (prorated based on date of hire and by full-time or part-time status) during the first year of employment
• 10 sick days (prorated)
• Paid holidays
• May be eligible for Truist’s defined benefit pension plan (depending on the position and division)
• May be eligible for restricted stock units (depending on the position and division)
• May be eligible for a deferred compensation plan (depending on the position and division)

Additional Information

• Language fluency: English (Required)
• Work shift: 1st shift (United States of America)
• Regular or temporary: Regular