Senior Application Security Engineer

J2B Global LLC is seeking a Senior Application Security Engineer for a contract engagement in San Jose, CA with onsite work on a 5 days per week schedule. This role is centered on hands-on application security across distributed systems and microservices, with a focus on vulnerability analysis, secure code review, and validating security patches in production-bound workflows.

In this position, you will build and use security tooling, investigate scanner results, reproduce issues with practical proofs, and help engineering teams drive fixes that hold up under testing. You will also contribute to long-term improvements in secure software development by tracking vulnerabilities through their lifecycle and refining validation practices.

Responsibilities

• Develop security tools, testing utilities, vulnerability reproduction scripts, and automated validation frameworks using Java, C++, or Python.
• Assess application architecture, including trust boundaries, data flows, attack surfaces, and security weaknesses across distributed systems and microservices.
• Review security scanner findings, reproduce vulnerabilities, create Proofs of Concept (PoCs), and separate true issues from false positives.
• Conduct detailed source code reviews to identify security flaws, insecure coding practices, potential exploits, and software regressions.
• Review, test, and validate security patches, including AI-generated and automated code fixes.
• Create test harnesses and run unit, regression, and security tests to confirm remediation effectiveness.
• Use threat modeling methodologies to identify architectural risks and recommend secure design and implementation practices.
• Evaluate vulnerabilities using CVE, CWE, OWASP Top 10, severity classifications, and remediation SLAs.
• Partner with software engineers, architects, and code owners to implement security fixes and support production deployment.
• Track vulnerabilities across their lifecycle and support continuous improvements in secure software development.

Requirements

• 8+ years of experience in software engineering, security software development, application security, or security engineering.
• Strong hands-on programming and debugging skills in at least one of Java, C++, or Python.
• Experience with multiple languages is preferred.
• Extensive experience with software development, code analysis, troubleshooting, and resolving complex technical issues.
• Strong understanding of application security, secure coding standards, vulnerability identification, and remediation techniques.
• Experience reproducing security vulnerabilities and validating fixes through coding, testing, and debugging.
• Proficiency in source code reviews, unit testing, regression testing, and identifying security-related code defects.
• Knowledge of threat modeling frameworks such as STRIDE and PASTA.
• Understanding of architectural trust boundaries, attack surfaces, data flows, and threat analysis.
• Familiarity with CVE, CWE, OWASP Top 10, vulnerability severity assessment, and security remediation SLAs.
• Experience building security test harnesses, test environments, or PoCs for vulnerability validation.
• Ability to assess automated code changes and identify security issues, functional regressions, and implementation weaknesses.

Technologies

• Java, C++, Python
• STRIDE, PASTA
• CVE, CWE, OWASP Top 10
• SAST/DAST tools
• PoCs
• AI-generated code