Secure Sdlc

Secure Sdlc Engineer Jobs

5 jobs found

1d ago

Sr. Application Security Engineer

Extra Space Management, Inc Salt Lake City, UT

Salt Lake City, UT

1d ago

Full time Senior Ai Security Application Security

Apply Now

Job Description

Sr. Application Security Engineer role in Salt Lake City, UT (hybrid), embedded with product and engineering teams to strengthen security across the software delivery lifecycle.

Responsibilities

Lead security architecture and design reviews for new and evolving features, identifying risk early and proposing practical mitigations
Run threat modeling and perform manual and automated code reviews, partnering with developers to prioritize and remediate findings
Apply a risk-based approach to application security, explaining vulnerabilities in terms of business impact
Help mature Secure SDLC with secure coding standards, security requirements, and automated checks in CI/CD pipelines, including SAST, DAST, SCA, and secrets scanning
Build and maintain security tooling and automation that scales across teams, focused on reducing risk
Own and grow the security champions program, training champions so security expertise is available within each team
Serve as an application security subject matter expert for engineering, product, and leadership; mentor engineers on secure development practices
Ensure AI tools and AI-powered features are adopted within acceptable risk limits
Align applications with SOC 1, SOX, CIS v8, and PCI DSS (including SAQ-A and SAQ-P2PE); support audits with evidence and remediation plans

Requirements

6+ years combined experience in software engineering, application security, product security, or a closely related field
Proficiency in primary languages: C# .NET, TypeScript, JavaScript, SQL
Experience securing web applications using modern frameworks and cloud-native architectures, with emphasis on AWS
Hands-on white-box testing and secure code review experience
Strong understanding of SSDLC principles, including implementing or maturing secure development programs
Working knowledge of common vulnerabilities and attack techniques, including OWASP Top 10, API security, and authentication/authorization flaws
Experience integrating security tooling into delivery pipelines using GitHub, TeamCity, or similar
Familiarity with AI security risks and emerging attack surfaces, including agentic systems, MCP, and LLM-powered workflows
Risk-focused mindset: translate security risk into business terms, weigh against risk tolerance and needs, and support pragmatic decisions without security theater
Demonstrated ability to build trusted relationships with engineering teams and influence behavior without direct authority
Strong written and verbal communication, comfortable in both design reviews and leadership risk discussions

Technologies

AWS, Vercel, C# .NET, TypeScript, JavaScript, React/Next.js, SQL Server, SQL
SAST, DAST, SCA, secrets scanning, CI/CD, GitHub, TeamCity
SOC 1, SOX, CIS v8, PCI DSS, SAQ-A, SAQ-P2PE
OWASP Top 10, API security, SSDLC
Agentic systems, MCP, LLM-powered workflows
Secure coding standards

Preferred Qualifications

Development experience with Next.js, Vercel, or serverless architectures
Practical knowledge of security frameworks and standards such as OWASP ASVS, NIST 800-53, CIS v8, PCI DSS, or SOX
Hands-on security certifications such as OSCP, BSCP, GWEB, PNPT, or similar
Experience running or triaging a bug bounty program
Bachelor’s degree in Computer Science, Information Security, or a related field

Work Environment & Physical Requirements

Sedentary work in an office environment; limited lifting (less than 10 pounds) or walking required
Close visual acuity required to perform work at a computer terminal
No exposure to adverse environmental conditions
Requires repetitive typing motion, talking, hearing, grasping, and feeling

Applications deadline: Applications will be accepted until the position is filled.

View full job page →

3d ago

Senior Application Security Engineer

PlayStation Global San Diego, CA

San Diego, CA

3d ago

$177k - $266k/yr Full time Senior Application Security Cloud Platforms

Apply Now

Job Description

PlayStation Global is seeking a senior application security engineer to strengthen secure software delivery across the SDLC. In this onsite role in San Diego, you will design and operationalize security practices, run threat-focused reviews, and mentor teams so security is built into everyday engineering workflows.

This position sits within Product Security and emphasizes cross-functional influence, hands-on risk identification, and practical guidance that aligns business goals with secure execution.

What you will do

Lead security initiatives across the SDLC and improve development practices using scalable automation.
Guide and conduct threat modeling and help define security requirements early in design phases.
Collaborate with developers, architects, and product managers to align business objectives with security needs.
Own security architecture and perform code reviews for distributed systems.
Run hands-on testing to uncover risks, then drive remediation in coordination with vulnerability and incident response teams.
Advance the Product Security strategy through multi-functional initiatives and cultural influence.
Provide technically grounded, pragmatic recommendations that balance business and security risk.
Capture learnings and convert them into reusable organizational assets that improve the overall security posture.
Mentor engineers and practitioners to reinforce secure-by-default thinking and shared accountability.
Demonstrate proactive leadership by coordinating delivery of measurable security and business impact.

Minimum qualifications

7+ years of experience in information security and 3+ years of software development.
Bachelor's degree or equivalent in Computer Science, Information Security, or a related field.
Effective communication and leadership skills, with the ability to influence both technical and non-technical collaborators including management.
Dedicated, proactive approach with the ability to find opportunities and lead initiatives independently.

Technical skills

Deep understanding of enterprise and cloud-native architectures, including secure design.
Expertise in network and web protocols and common attack vectors: TCP/IP, TLS, HTTPS, OAuth 2.0, OpenID Connect.
Proven ability to guide security development and code evaluations, delivering actionable, risk-based recommendations.
Experience across multiple programming languages (e.g., Java, C/C++, JavaScript, Python) and mitigating vulnerabilities such as OWASP Top 10.
Experience integrating SAST, DAST, and dependency scanning into CI/CD pipelines.
Familiarity with Agile and DevOps delivery practices.
Hands-on cloud experience including AWS, Azure, GCP, Kubernetes, service mesh, and CDN, with secure configuration and identity management.
Strong analytical and problem-solving skills using an attacker perspective to anticipate and simulate real-world attacks.
Experience with penetration testing, automated testing, or testing frameworks such as JUnit, pytest, REST Assured, and Playwright.

Preferred

Security certifications such as GIAC, OSCP, CEH, CISSP, CCSP, or equivalent.

Location: San Diego, CA (onsite)
Compensation: USD 177,300 - 265,900 per year

View full job page →

1mo ago

Senior InfoSec Engineer

MEDIDATA Houston, TX 🇺🇸 Remote

Houston, TX

1mo ago Closed

$103k - $153k/yr Full time Senior Application Security Application Security Engineering

This position is no longer accepting applications (closed Oct 29, 2026).

Job Description

Medidata is hiring a Senior InfoSec Engineer in Houston, TX (remote) to strengthen application security across the SDLC, including secure release pipeline support and threat-informed engineering practices.

Responsibilities

Embed secure SDLC practices across the development lifecycle, including SAST/DAST, open-source component management, threat modeling, and architectural security reviews
Oversee and improve source code control and source code management (SCM) to help enable secure, streamlined release pipelines
Use core programming and application engineering knowledge to influence secure best-practice architecture and implementation
Apply working knowledge of web and networking concepts, including Web Services, Service-Oriented/Object-Oriented Architectures, and HTTP, to support robust system communication
Support modern infrastructure deployment by managing Infrastructure as Code (IaC) and performing Kubernetes Cluster Administration
Use experience with HTML, JavaScript, and strong HTTP understanding to improve frontend integrations and web security
Review and improve codebase integrity using hands-on development experience across languages such as .NET (C#), Java, Ruby, Python, JavaScript, TypeScript, AngularJS, and ReactJS
Implement and maintain data solutions across Relational Databases (MySQL, MS SQL, Oracle) and Non-Relational Databases (MongoDB, DynamoDB, Redis)
Support and manage Secure AI workflows in SDLC (AI code generation tools such as Copilot and ClaudeCode) and in application features where AI supports customer-facing functionality
Apply information security principles to proactively identify, mitigate, and defend against malicious code and common hacker techniques and web application vulnerabilities
Coordinate with other teams to deploy and maintain solutions in an appropriate and cost-effective manner

Requirements

Bachelor’s degree (or above) in Computer Science/Engineering, Information Technology, or comparable; plus 3-5 years of related experience (required)
AWS or vendor-agnostic cloud management certification is a plus
CISSP or equivalent certification is a bonus
Source code and artifact management: Git, GitHub, Artifactory
CI/CD pipelines: GitHub Actions
Scripting languages: Python, TypeScript
Programming languages: Java, .NET (Java/.NET focus)
Hosting architectures: Cloud and self-hosted
Security testing exercises: SAST, DAST

Technologies

SAST, DAST, open-source components
Web Services, Service-Oriented Architecture, Object-Oriented Architectures
HTTP
Infrastructure as Code (IaC), Kubernetes
HTML, JavaScript, .NET (C#), Java, Ruby, Python, TypeScript, AngularJS, ReactJS
MySQL, MS SQL, Oracle, MongoDB, DynamoDB, Redis
AI code generation tools: Copilot, ClaudeCode
Git, GitHub, Artifactory, GitHub Actions
AWS

Benefits

Medical, dental, life and disability insurance
401(k) matching
Family leave
Flexible paid time off
10 paid holidays per year

Location

Remote (Houston, TX)
Medidata follows a hybrid office policy for in-person roles, with on-site days per company policy

About the Team

The Information Security Application Architecture team designs, evaluates, and enforces application security across all phases of the SDLC
Works with Engineering, Privacy, and DevOps teams to define and implement application security standards, perform software architecture design reviews, and conduct threat modeling
Performs white box security testing and supports vulnerability identification, interpretation, and remediation across applications, languages, and platforms
Reports to the Manager of Application Security & Sourcing

Compensation

Salary range (NYC Metro Area positions physically based): $114,750-$153,000
Salary range (all other United States locations): $102,750-$137,000
Pay ranges are based on function, level, candidate expertise and experience, and geographic location
Compensation is commensurate with experience; total expected compensation range between $102,750 and $137,000 (base salary plus target bonus)

Equal Employment Opportunity

Employment decisions based on merit, qualifications, and abilities
Non-discrimination and equal opportunity without regard to protected characteristics
Reasonable accommodations for qualified individuals with known disabilities
Accepting applications on an ongoing basis until the role is filled
#LI-EM1
#LI-Hybrid

Inclusion Statement

Employment and advancement based on merit, qualifications, and abilities
Non-discrimination and equal opportunity for all employees and qualified applicants
Reasonable accommodations for qualified individuals with known disabilities
Qualified applicants with arrest or conviction records considered in accordance with applicable state laws and local ordinances

View full job page →

2mo ago

Principal Product Security Engineer

Navy Federal Credit Union Winchester, VA

Winchester, VA

2mo ago Closed

Full time Senior Application Security Application Security Engineering

This position is no longer accepting applications (closed Sep 20, 2026).

Job Description

Navy Federal Credit Union is looking for a senior, individual contributor Principal Product Security Engineer to shape how secure software is delivered across the organization. In this onsite role in Winchester, VA, you will define and integrate Secure Software Development Lifecycle (Secure SDLC) practices into Navy Federal’s software delivery workflows, serving as an integration lead between product security expectations and engineering execution.

This position is designed for a partner who can translate security standards and risk expectations into practical engineering requirements, support governance and lifecycle risk decision points, and drive adoption measures that improve developer experience and product security outcomes at scale.

Summary

Principal Product Security Engineer - Secure Development Lifecycle is a senior individual contributor role that defines and integrates Secure SDLC practices into software delivery workflows.
Acts as an integration lead, aligning product security expectations with engineering and technology processes, governance forums, and lifecycle risk decision points.

Responsibilities

Define and mature Secure Software Development Lifecycle practices aligned to Navy Federal software delivery processes, operating models, and secure development practices.
Define and support a pre-production product security scorecard for risk-informed release decisions, communicating product security posture, open risks, exceptions, and required remediation actions to business and technology stakeholders.
Serve as the senior individual contributor integration lead for embedding Secure Development Practice capabilities into engineering workflows, governance forums, and lifecycle activities.
Map product security activities to software delivery processes including intake, planning, architecture review, design, development, testing, release, exception management, and operational handoff.
Establish repeatable process patterns to integrate threat modeling, secure coding, application security testing, software composition analysis, API security, software supply chain security, product integrity testing, and risk-based exception handling.
Identify and reduce redundant reviews, unclear handoffs, late-stage security friction, and legacy process steps that do not align with Navy Federal software delivery practices.
Develop Secure SDLC operating models, workflow diagrams, playbooks, process documentation, RACI models, control integration points, and implementation guidance.
Translate security standards, objectives, and risk expectations into practical engineering requirements and developer-consumable guidance.
Partner with software engineering, architecture, DevSecOps, Information Security, governance, and risk stakeholders to align secure development practices with enterprise delivery processes.
Support integration of secure development expectations into architecture governance, delivery boards, exception processes, and lifecycle risk decision points.
Recommend process improvements that strengthen security outcomes, improve developer experience, increase risk visibility, and enable secure delivery at scale.
Establish adoption and effectiveness measures to demonstrate Secure SDLC maturity, control integration, developer enablement, reduced friction, and improved product security outcomes.
Lead cross-functional working sessions, develop executive-ready recommendations, and influence process decisions across security and engineering stakeholders without direct authority.

Requirements

Bachelor’s degree in information technology, Cybersecurity, Computer Science, Software Engineering, Information Systems, Engineering, or related field, or the equivalent combination of education, training, and experience.
Experience defining, improving, or integrating secure development lifecycle practices into enterprise software delivery processes.
Strong understanding of secure development practices including threat modeling, secure coding, application security testing, software composition analysis, API security, software supply chain security, vulnerability management, and risk-based exception handling.
Extensive hands-on experience translating security requirements, control objectives, or risk expectations into practical engineering processes, workflow guidance, and delivery requirements.
Demonstrated experience developing process documentation, operating models, workflow diagrams, playbooks, standards, RACI models, implementation guidance, or executive-level recommendations.
Strong facilitation, analytical thinking, systems thinking, problem-solving, communication, and stakeholder influence skills.
Ability to operate independently as a senior individual contributor and lead complex cross-functional initiatives without direct reporting authority.

Technologies

Secure Software Development Lifecycle
Threat modeling
Secure coding
Application security testing
Software composition analysis
API security
Software supply chain security
Vulnerability management
DevSecOps
NIST Secure Software Development Framework
OWASP SAMM
OWASP ASVS
OWASP Top 10
BSIMM
ISO 27001
NIST Cybersecurity Framework
Agile
SAFe
DevOps
CI/CD
Product-oriented delivery
Architecture governance
Release management
CISSP
CISM
CSSLP
CCSP
GIAC

Desired Qualifications

Extensive hands-on experience in application security, secure SDLC, software engineering, DevSecOps, enterprise architecture, technology risk, or software delivery governance.
Strong understanding of software delivery practices including Agile, SAFe, DevOps, DevSecOps, CI/CD, product-oriented delivery, architecture governance, and release management.
Advanced degree in Information Technology, Cybersecurity, Computer Science, Software Engineering, Information Systems, Engineering, Business Administration, or related field.
Experience with industry frameworks or models such as NIST Secure Software Development Framework, OWASP SAMM, OWASP ASVS, OWASP Top 10, BSIMM, ISO 27001, NIST Cybersecurity Framework, or similar security and software assurance practices.
CISSP, CISM, CSSLP, CCSP, GIAC, cloud security, architecture, Agile, SAFe, or related professional certifications.

Work Schedule

Monday - Friday, 8:00AM - 4:30PM

Location

Onsite: 141 Security Drive, Winchester, VA 22602

Bank Secrecy Act

Remains cognizant of and adheres to Navy Federal policies and procedures, and regulations pertaining to the Bank Secrecy Act.

View full job page →

3mo ago

Staff, Application Security Engineer - Product Security

Walmart Bentonville, AR

Bentonville, AR

3mo ago Closed

$110k - $264k/yr Full time Application Security Cybersecurity Tools Defense In Depth

This position is no longer accepting applications (closed Aug 27, 2026).

Job Description

What Walmart offers

Join Walmart’s Information Security team in Bentonville, where you help secure the world’s largest retail operation. This role emphasizes security automation and governance layered into developer workflows, with secure-by-default guidance and audit-ready validation across Walmart’s application ecosystem. You will work onsite at 2501 Se J St, Ste A, Bentonville, AR, contributing to solutions that enable customers to Save Money and Live Better while supporting Fortune 1 priorities through scalable, automated governance.

Health benefits including medical, vision, and dental coverage
Financial benefits such as a 401(k), stock purchase opportunities, and company-paid life insurance
Comprehensive paid time off for vacation, sick leave, parental leave, family care leave, bereavement, jury duty, and voting
Additional benefits including short-term and long-term disability, company discounts, Military Leave Pay, and adoption and surrogacy expense reimbursement
PTO or PPTO that can be used for vacation, holidays, or other needs
Live Better U education benefit program and Walmart covering tuition, books, and fees
Opportunity to work on critical security initiatives that balance risk and business momentum

What you will do

Partner with technology and business stakeholders to embed security early in the product lifecycle
Define and govern secure architecture patterns, configuration standards, and enterprise control logic for scalable security validation
Develop deep knowledge of Walmart products and platforms to provide secure-by-default implementation guidance
Design and validate automated control logic that yields defensible, risk-aligned validation outcomes
Apply threat modeling, penetration and security testing, and code reviews to accelerate high-priority business initiatives
Evaluate SAST and SCA outputs to ensure accurate risk detection and reduce misconfiguration exposure
Serve as a trusted partner for architecture and configuration reviews that securely enable business initiatives
Map security controls to applicable compliance frameworks and generate reliable audit evidence
Build strong cross-functional partnerships to speed time to market while maintaining security integrity
Provide secure design, development, implementation, sustainment, and governance expertise across the application lifecycle
Document product security standards, validation logic, and governance decisions
Develop and evolve metrics to measure the effectiveness of automated product security controls
Mentor and share knowledge to advance secure engineering maturity and communicate clearly with stakeholders
Support Walmart’s priority initiatives through scalable, automated security governance
Embed secure standards and validation logic directly into engineering workflows to reduce manual security reviews
Collaborate on global solutions that help customers Save Money and Live Better
Demonstrate deep expertise in OWASP risks, secure coding patterns, and threat modeling; define secure-by-default standards and risk tradeoffs
Governs secure architecture and configuration baselines across enterprise environments, including authorization models, database hardening, and input validation frameworks
Design and validate security controls, map them to compliance frameworks, and produce defensible audit evidence
Align technical security decisions with enterprise risk modeling and risk acceptance frameworks
Enjoy solving complex technical challenges while partnering to accelerate scalable business initiatives

Requirements

Option 1: Bachelor’s degree in computer science, information technology, engineering, information systems, cybersecurity, or related field plus 4 years of experience in application security or a related area at a technology, retail, or data-driven company
Option 2: 6 years of experience in application security or a related area at a technology, retail, or data-driven company

Technologies

SAST
SCA

Location and compensation

Primary location is onsite in Bentonville, Arkansas. Salary ranges reflect location and experience. The annual base salary range is USD 110,000 to 264,000, with Bentonville listed as 110,000 to 220,000 and Herndon listed as 132,000 to 264,000. Additional compensation may include annual or quarterly performance bonuses, and stock for certain positions.

View full job page →

Secure Sdlc Engineer Jobs

Sr. Application Security Engineer

Senior Application Security Engineer

Senior InfoSec Engineer

Principal Product Security Engineer

Staff, Application Security Engineer - Product Security

Get Secure Sdlc Engineer Jobs alerts