PACCAR is seeking an Application Security Engineer to support the IT Division’s Global Security group. The position focuses on providing security guidance across the application portfolio, with hands-on work spanning secure code review, automated security testing, vulnerability assessment, and SDLC risk analysis.
Onsite Location
Renton, WA, US (onsite)
Compensation
USD 90,000 - 141,000 per year
Role Responsibilities
- Conduct source code reviews using manual analysis and Static Application Security Testing (SAST) tools to identify vulnerabilities.
- Perform web security assessments on websites, web applications, web services, and APIs using Dynamic Application Security Testing (DAST) tools.
- Review results from automated security tools, confirm automated tests complete successfully, and identify and remove false positives from tool reports.
- Develop and review threat models to proactively surface security risks.
- Partner with development teams to support vulnerability remediation through consultation or hands-on assistance.
- Help developers understand security defects, associated risk, and define acceptable solutions to remediate issues.
- Collaborate with teams to embed secure coding practices and security tooling into CI/CD pipelines.
- Contribute to code reviews and design discussions while applying a security lens.
- Support application security controls and contribute to risk analysis of applications throughout the SDLC.
- Contribute to the creation, maintenance, and communication of PACCAR secure coding standards, guidelines, and examples.
- Assist in implementation of secure design principles aligned to organizational policies, standards, and application security patterns.
- Create technical security documents, including assessment reports and remediation guidance.
- Share application security knowledge with engineering teams through brown bags, secure coding tournaments, and developer outreach activities.
- Help improve security culture and awareness across the organization.
- Participate in security incident response when needed.
- Maintain and tune Secure SDLC tools including SAST, DAST, and Software Composition Analysis (SCA) platforms.
- Support integration of security tooling and automated security checks within CI/CD.
- Stay current with application security technologies, products, and emerging trends.
Required Qualifications
- Bachelor’s degree in Computer Science, Information Systems, Software Engineering, Cybersecurity, or a related field.
- 5+ years of professional experience in application or software security, including hands-on work in secure code review, vulnerability assessment, threat analysis, or secure development practices.
- Hands-on experience with application security testing tools, including DAST platforms (e.g., Burp Suite, WebInspect, OWASP ZAP) and SAST/SCA tools (e.g., Fortify, Checkmarx, SonarQube).
- Proficiency in one or more programming languages: C#, JavaScript, and/or Python.
- Strong working knowledge of web application technologies including HTTP, HTML, CSS, JavaScript.
- Expert-level understanding of the OWASP Top 10 and common web application vulnerabilities, including website security concepts such as headers, cookies, CORS, XSS, and CSRF.
- Familiarity with web authentication technologies such as OAuth and/or SAML.
- Experience with SDLC and development methodologies such as Waterfall and Agile.
- Experience with control systems including Git, GitHub, Azure DevOps.
- Experience working in a large enterprise environment.
- Experience with penetration testing or security tools (e.g., Kali Linux, Nmap).
- Familiarity with cloud environments such as Azure, AWS, or GCP.
- Certifications: CSSLP, CISSP, and CompTIA Security+.
Skills and Tools
Secure SDLC tools including SAST, DAST, and SCA; Burp Suite, WebInspect, OWASP ZAP, Fortify, Checkmarx, and SonarQube; programming languages and web technologies including C#, JavaScript, Python, HTTP, HTML, CSS; security concepts including headers, cookies, CORS, XSS, and CSRF; authentication technologies including OAuth and SAML; SDLC and development methodologies including Waterfall and Agile; Git, GitHub, Azure DevOps; penetration testing tools such as Kali Linux and Nmap; cloud environments including Azure, AWS, and GCP; and CI/CD.
Benefits
- 401k with up to a 5% company match
- Employee Stock Purchase Program (ESPP)
- Fully funded pension plan providing monthly benefits after retirement
- Comprehensive paid time off: minimum 10 paid vacation days, 12 paid holidays, and sick time (additional vacation days provided with additional seniority/years of service)
- Tuition reimbursement for continued education
- Medical, dental, and vision plans for you and your family
- Flexible spending accounts (FSA) and health savings account (HSA)
- Paid short- and long-term disability programs
- Life and accidental death and dismemberment insurance
- EAP services including wellness plans, estate planning, financial counseling, and more
Equal Opportunity and Work Authorization
- PACCAR is an Equal Opportunity Employer and a Protected Veteran/Disability employer.
- Applicants and employees for this position will not be sponsored for work authorization, including H-1B visas, now or in the future.
Additional Notice
The role salary range is $90,000 - $141,000 annually, and the position is eligible for the full range of benefit options listed above.
