Senior Application Security Engineer

About the Role

Blue Cross and Blue Shield of Nebraska (BCBSNE) is mission-driven, focused on advancing the health and well-being of members and the communities it serves. As Senior Application Security Engineer, you will serve as a technical leader and owner of application security capabilities. You will implement and operate secure software development practices across the enterprise, with emphasis on static and dynamic code analysis, DevSecOps integration, AI-related code risk, and risk-based vulnerability management.

This role is designed for an experienced practitioner who can work independently, own outcomes, and partner with engineering, architecture, and risk teams to deliver security solutions that are practical and scalable.

The ideal candidate lives within driving distance of the Omaha, Nebraska office. Remote flexibility is available with 1 day per week in the office.

If you live in one of the approved states (Florida, Iowa, Kansas, Minnesota, Missouri, Nebraska, North Dakota, and Texas), travel to headquarters may be required based on business needs.

What You’ll Do

• Own and operate application security tooling, including SAST, DAST, and software composition analysis, ensuring tools are tuned, effective, and aligned to business risk.
• Embed application security into CI/CD pipelines and development workflows to support shift-left security while minimizing developer friction.
• Perform secure code reviews and validate vulnerabilities for exploitability, impact, and remediation feasibility.
• Define and maintain secure coding standards, guidance, and reusable security patterns for development teams.
• Establish guardrails and review expectations for AI-assisted and AI-generated code to reduce unowned and unmanaged application risk.
• Partner with development teams to triage findings, reduce false positives, and drive effective remediation.
• Apply risk-based decision making aligned to organizational risk appetite and compliance frameworks (NIST, HIPAA, SOC 2).
• Support application threat modeling and help identify architectural security gaps.
• Collaborate with cloud, platform, and identity teams to ensure applications integrate securely with enterprise services.
• Contribute to audit readiness, evidence collection, and regulatory support related to application security controls.
• Reduce single points of failure by documenting processes, mentoring others, and improving program resiliency.

What You’ll Need

• Bachelor’s degree in Computer Science, Information Security, or a related field (or equivalent experience).
• 6 years of experience in application security, secure software development, or DevSecOps.
• Hands-on experience with SAST, DAST, and dependency scanning tools, including tuning and operational ownership.
• Strong understanding of application vulnerability classes (OWASP Top 10, APIs, authentication, authorization).
• Experience integrating security into CI/CD pipelines and development workflows.
• Proven ability to assess risk, prioritize remediation, and clearly communicate decisions.
• Comfort working independently, taking ownership, and driving outcomes with minimal oversight.
• Strong communication skills and the ability to work effectively with developers, architects, and leadership.

Preferred Qualifications

• Experience in healthcare or other regulated industries.
• Familiarity with Azure PaaS and cloud-native application architectures.
• Exposure to AI-assisted development risks, automation, or modern code-generation tools.
• Threat modeling experience and participation in security design reviews.
• Scripting or automation experience (Python, PowerShell, Bash).
• Relevant certifications (CSSLP, GWAPT, CISSP, or equivalent).

Additional Information

An equivalent combination of education and experience may be substituted for the education requirement. The ability to meet or exceed attendance and timeliness requirements of the department is required. On-call work may be required based on business needs and role assignment.

To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. Requirements listed are representative of the knowledge, skill, and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform essential functions. Other duties may be assigned.

What We Offer

Learn more about BCBSNE’s Total Rewards package at NebraskaBlue.com/Careers.

BCBSNE values diversity of experience, perspective, and background to support a better workplace for employees and a better product for customers and members.

Job Scam Safety

BCBSNE only accepts job applications submitted through its official careers website. Genuine correspondence will come from an email address ending with @nebraskablue.com. BCBSNE does not ask for sensitive personal information such as banking details, and interviews take place before any job offer is made.

Equal Opportunity Statement

BCBSNE is an Equal Opportunity / Affirmative Action Employer, M/F/D/V. If you are a qualified individual with a disability or a disabled veteran, you have the right to request an accommodation if you are unable or limited in your ability to use or access the career center due to your disability. To request an accommodation, contact a Human Resources Representative at BCBSNE.