Sr. IT Application Security Engineer

Career Developers is seeking a Senior IT Application Security Engineer to strengthen enterprise web and application protections and integrate security into SDLC and CI/CD workflows.

Responsibilities

• Administer and enhance enterprise BIG-IP WAF capabilities: build security policies, tune rules, investigate false positives, troubleshoot application traffic issues, and maintain effective web application protections
• Design, implement, and operate application security controls across enterprise applications and supporting platforms
• Perform container image security scanning; analyze vulnerabilities found in application and container images
• Evaluate container vulnerability severity and business risk; partner with development teams to prioritize and remediate findings
• Collaborate with Development and DevOps to embed security controls into SDLC and CI/CD pipelines
• Design and operate web application and API security protections: policy configuration, rule tuning, automation, and ongoing improvements
• Identify application security vulnerabilities and perform risk assessments; recommend practical mitigation and remediation strategies
• Develop and maintain application security policies, standards, procedures, and controls
• Develop security monitoring and telemetry for the application stack to support proactive detection
• Conduct technical investigations related to application security incidents and vulnerabilities
• Support container security initiatives including image scanning, vulnerability risk assessments, and runtime security and hardening
• Operate and support security technologies across cloud and/or on-premises environments
• Troubleshoot security, application, and network-related issues and communicate technical findings and recommended actions
• Partner with senior IT stakeholders to interpret application security risks, priorities, and remediation needs

Requirements

• 6–8 years of Application Security experience designing, implementing, and operating security controls in enterprise application environments
• Hands-on BIG-IP WAF administration: build WAF policies, configure protections, tune rules and policies, troubleshoot issues, reduce false positives, and maintain WAF controls in production
• Hands-on container image security and scanning experience: review scan results, evaluate vulnerabilities, determine risk and remediation priorities, and work directly with development teams to resolve findings
• Experience with a container security/scanning platform (tool not critical), including platforms such as Prisma Cloud, Wiz, Snyk, or comparable technologies
• Strong web application security knowledge, including OWASP Top 10 vulnerabilities and practical application of security controls
• Experience conducting web application security scans, vulnerability assessments, and/or penetration testing
• Experience partnering with Development and DevOps teams to integrate security into SDLC and CI/CD pipelines
• Experience with authentication and authorization technologies such as OAuth and OpenID
• Strong troubleshooting and communication skills, including explaining security risks and remediation requirements to technical teams and senior IT stakeholders
• Bachelor’s degree in Information Security, Computer Science, Computer/Electrical Engineering, or a related discipline, and/or equivalent relevant professional experience

Technologies

• BIG-IP WAF
• Container image security/scanning
• Container security/scanning platforms: Prisma Cloud, Wiz, Snyk (or comparable)
• OWASP Top 10
• OAuth, OpenID
• SDLC, CI/CD
• Web application security scanning
• Penetration testing

Location

• Hybrid / Reston, VA
• 3 days on-site per week (Tues/Wed)

Compensation

• USD 150,000 - 180,000 per year
• 7% bonus