Senior Application Security Engineer

PlayStation Global is seeking a senior application security engineer to strengthen secure software delivery across the SDLC. In this onsite role in San Diego, you will design and operationalize security practices, run threat-focused reviews, and mentor teams so security is built into everyday engineering workflows.

This position sits within Product Security and emphasizes cross-functional influence, hands-on risk identification, and practical guidance that aligns business goals with secure execution.

What you will do

• Lead security initiatives across the SDLC and improve development practices using scalable automation.
• Guide and conduct threat modeling and help define security requirements early in design phases.
• Collaborate with developers, architects, and product managers to align business objectives with security needs.
• Own security architecture and perform code reviews for distributed systems.
• Run hands-on testing to uncover risks, then drive remediation in coordination with vulnerability and incident response teams.
• Advance the Product Security strategy through multi-functional initiatives and cultural influence.
• Provide technically grounded, pragmatic recommendations that balance business and security risk.
• Capture learnings and convert them into reusable organizational assets that improve the overall security posture.
• Mentor engineers and practitioners to reinforce secure-by-default thinking and shared accountability.
• Demonstrate proactive leadership by coordinating delivery of measurable security and business impact.

Minimum qualifications

• 7+ years of experience in information security and 3+ years of software development.
• Bachelor's degree or equivalent in Computer Science, Information Security, or a related field.
• Effective communication and leadership skills, with the ability to influence both technical and non-technical collaborators including management.
• Dedicated, proactive approach with the ability to find opportunities and lead initiatives independently.

Technical skills

• Deep understanding of enterprise and cloud-native architectures, including secure design.
• Expertise in network and web protocols and common attack vectors: TCP/IP, TLS, HTTPS, OAuth 2.0, OpenID Connect.
• Proven ability to guide security development and code evaluations, delivering actionable, risk-based recommendations.
• Experience across multiple programming languages (e.g., Java, C/C++, JavaScript, Python) and mitigating vulnerabilities such as OWASP Top 10.
• Experience integrating SAST, DAST, and dependency scanning into CI/CD pipelines.
• Familiarity with Agile and DevOps delivery practices.
• Hands-on cloud experience including AWS, Azure, GCP, Kubernetes, service mesh, and CDN, with secure configuration and identity management.
• Strong analytical and problem-solving skills using an attacker perspective to anticipate and simulate real-world attacks.
• Experience with penetration testing, automated testing, or testing frameworks such as JUnit, pytest, REST Assured, and Playwright.

Preferred

• Security certifications such as GIAC, OSCP, CEH, CISSP, CCSP, or equivalent.

Location: San Diego, CA (onsite)
Compensation: USD 177,300 - 265,900 per year