Owasp Top Ten

Owasp Top Ten Engineer Jobs

3 jobs found

Today

Senior Security Engineer

FHLBanks Office of Finance Reston, VA

Reston, VA

Today

$140k - $202k/yr Full time Senior Api Security Application Security

Apply Now

Job Description

Senior Security Engineer will strengthen application security by embedding controls into the SDLC and CI/CD pipelines and improving proactive detection for web and APIs.

Responsibilities

Develop and maintain software application security policies and procedures
Implement software application security controls
Partner with DevOps teams to develop and support a secure CI/CD pipeline
Design and operate web application firewall (WAF) and API protections, including rule tuning, false-positive reduction, and automated policy updates
Identify application security vulnerabilities and issues, perform risk assessments, and provide mitigations
Develop security monitoring for the application stack
Conduct technical investigations of application security incidents
Interface with senior stakeholders across the IT leadership team to interpret risks and priorities proactively
Support the OF diversity and inclusion strategy by following policies and procedures that ensure opportunities for employees and diverse business partners
Assist with other job duties as assigned

Requirements

6 to 8 years of experience in Application Security (designing, implementing, and operating security controls in enterprise application environments)
Hands-on experience with web application security, including OWASP Top 10 vulnerabilities
Hands-on experience with WAF/API security (policy design, rule tuning, automation)
Hands-on experience with container security, including runtime hardening, image scanning, and vulnerability risk assessments
Hands-on experience conducting web application security scans, vulnerability assessments, and/or penetration testing
Experience investigating problems and processes using established methodologies and best practices
Experience working with Authentication and Authorization services such as OAuth and OpenID
Experience operating on-prem or cloud-based security platforms
Ability to troubleshoot security and network-related issues and communicate technical findings effectively
Ability to listen and integrate ideas from diverse individuals, build respectful relationships, collaborate, and resolve conflicts constructively
Bachelor’s Degree in Information Security or Computer Science or Computer/Electrical Engineering, or equivalent field experience
Proof of eligibility to work in the United States

Skills and Technologies

OWASP Top 10
Web application firewall (WAF)
OAuth
OpenID

Position Summary

Designs, implements, operates, and continuously improves OF security technologies and controls across applications and supporting platforms
Primary focus on Application Security by embedding security into the SDLC and CI/CD pipelines
Strengthens web and API protections and supports proactive detection
Contributes broadly to Security Engineering capabilities including identity, security platforms (cloud/on-prem), logging/telemetry, and automation
Partners with development, DevOps, and operations teams to build secure-by-default applications and services

Location and Compensation

Location: Reston, VA (onsite)
Salary: USD 140,441 to 202,303 per year

Core Values

Integrity: accountability, consistency, transparency, and trust
Agility: adaptability, continuous improvement, expertise, and flexibility
Partnership: collaboration, communication, leadership, and teamwork
Inclusivity: diversity, relationships, respect, and support

View full job page →

7d ago

Application Security Engineer

SpaceXSI Washington, DC

Washington, DC

7d ago

$100k - $258k/yr Full time Ai Security Application Security Burp Suite

Apply Now

Job Description

SpaceXSI is seeking an Application Security Engineer to help safeguard the security and integrity of payments and financial products throughout the software development lifecycle. This onsite role in Washington, DC focuses on strengthening application security controls across code, CI/CD pipelines, threat modeling, vulnerability management, and security tooling, including SBOMs and agentic or LLM-based approaches.

Key Responsibilities

Run in-depth code reviews and static analysis to identify, assess, and mitigate security vulnerabilities in financial applications
Design and implement secure coding guidelines and best practices for development teams
Work with development teams to incorporate security practices throughout the CI/CD pipeline
Conduct threat modeling and risk assessments for payments, wallets, ledgers, and related product surfaces, developing mitigation strategies for fraud, abuse, and unauthorized movement of funds or credits
Own vulnerability tracking and remediation efforts, providing guidance to engineering teams
Manage the bug bounty program, including intake, triage, researcher communication, and coordinated disclosure
Support application security incident response activities
Monitor emerging threats targeting financial and cloud-native systems and continuously improve security controls
Evaluate and secure software supply chains, including producing and maintaining Software Bills of Materials (SBOMs)
Design and implement agentic and LLM-based solutions to detect, investigate, or prevent security issues

Required Qualifications

Bachelor’s degree in Computer Science, Cybersecurity, or a related field
3-5 years of experience in application security, with a strong focus on code security practices
Experience in payments, money transmission, digital wallets, or related financial platforms
Strong understanding of secure coding practices, application security frameworks, and common vulnerabilities (including OWASP Top 10)
Proficiency in Python or Rust, plus secure coding experience in these languages
Experience securing CI/CD pipelines and applying DevSecOps practices
Familiarity with software supply chain security and SBOM generation tools
Experience with security testing tools (e.g., Burp Suite, OWASP ZAP) and static/dynamic code analysis
Experience securing payments, wallets, ledgers, or other high-value transaction systems, including controls against fraud, abuse, and integrity issues
Experience designing and implementing agentic and LLM-based solutions for security problems
Excellent communication skills, able to explain complex security topics to technical and non-technical audiences

Technologies

Python, Rust
OWASP Top 10
Burp Suite, OWASP ZAP
SBOMs and SBOM generation tools
DevSecOps
Agentic solutions, LLM-based solutions
CI/CD pipelines

Compensation and Benefits

$100,000 - $258,000 USD per year
Equity
Comprehensive medical, vision, and dental coverage
Access to a 401(k) retirement plan
Short & long-term disability insurance
Life insurance
Various other discounts and perks

Preferred Skills and Experience

Hands-on experience securing applications on AWS; familiarity with other cloud platforms is a plus
Relevant security certifications (e.g., BSCP, OSCP, OSWE)
Experience managing bug bounty programs
Background in data privacy and compliance relevant to financial products and cloud-native applications
Experience with GitOps and infrastructure-as-code security
Experience building custom security tooling to enhance and automate security processes
Contributions to open-source security projects or tools

ITAR Requirements

To conform to U.S. Government export regulations, applicants must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State.

View full job page →

1mo ago

Lead Engineer, Information Security (Application Security)

RXO, Inc. United States

United States

1mo ago Closed

Full time Ai Security Application Security Cloud Native Security

This position is no longer accepting applications (closed Oct 17, 2026).

Job Description

Lead Engineer, Application Security is a senior individual contributor role focused on scaling secure software practices across a multi-cloud environment.

Responsibilities

Own application security standards, secure architecture principles, and threat modeling governance across the enterprise.
Run security assessments and threat modeling for emerging technologies, including agentic AI solutions, LLMs, and autonomous AI workflows.
Review and optimize Web Application Firewall (WAF) configurations to support application protection goals.
Integrate and optimize automated security tooling such as SAST, DAST, and Software Composition Analysis (SCA) within CI/CD and DevSecOps processes.
Collaborate with software engineering teams to identify vulnerabilities and provide code-level remediation guidance aligned to secure coding best practices.
Support security awareness and enablement efforts by mentoring developers and facilitating Security Champion programs across engineering teams.
Evaluate cloud-native applications and services in Azure, GCP, and OCI to ensure alignment with security standards.
Help implement security controls in development pipelines, including mechanisms intended to block deployments with unresolved critical or high-risk vulnerabilities.
Drive continuous improvement to enhance application security processes, tooling, and developer enablement.

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related field (or equivalent combination of education and experience).
3+ years of experience in Application Security, Security Engineering, DevSecOps, or a related cybersecurity discipline.
Experience identifying and remediating security vulnerabilities within application code and software development environments.
Experience with enterprise WAF platforms such as Akamai App & API Protector, F5 Advanced WAF, or similar technologies.
Experience securing cloud-native workloads and applications in Azure, GCP, and/or OCI.
Experience with container technologies, including Docker and Kubernetes.
Experience integrating security tools into CI/CD pipelines and development workflows.
Knowledge of OWASP Top 10, CWE, secure API design principles, and application security best practices.
Strong analytical, problem-solving, and communication skills with the ability to collaborate across technical teams.

Technologies

Web Application Firewall (WAF)
Akamai App & API Protector
F5 Advanced WAF
SAST, DAST, Software Composition Analysis (SCA)
CI/CD, DevSecOps
Azure, Google Cloud Platform (GCP), Oracle Cloud Infrastructure (OCI)
Docker, Kubernetes
OWASP Top 10, Common Weakness Enumeration (CWE)
Agentic AI solutions, Large Language Models (LLMs)

Benefits

Comprehensive medical, dental, and vision plans
401(k) retirement plan with up to 5% company match
Pre-tax accounts to help streamline eligible expenses
Company-paid disability and life insurance
Employee Assistance Program (EAP)
Career and Leadership Development Programs
Paid time off, company holidays, and volunteer days

It’d be great if you also have

Experience securing AI-enabled applications, LLM-based solutions, or autonomous agent workflows.
Experience with security certifications such as Microsoft Certified: Azure Security Engineer Associate, GCP Professional Cloud Security Engineer, CISSP, CSSLP, CASE, GWEB, or related security certifications.
Experience with Akamai and/or F5 security platforms in large-scale enterprise environments.
Experience leading Security Champion programs or mentoring engineering teams on secure development practices.
Ability to influence cross-functional teams and drive security improvements through collaboration and technical expertise.
Experience developing scalable security frameworks that support innovation while managing enterprise risk.

View full job page →

Owasp Top Ten Engineer Jobs

Senior Security Engineer

Application Security Engineer

Lead Engineer, Information Security (Application Security)

Get Owasp Top Ten Engineer Jobs alerts