Protect the City’s digital infrastructure by securing applications across web, APIs, and mobile environments. This onsite role in Brooklyn, NY supports the Software Security Assurance Program (SSAP) through practical application security assessments, threat modeling, and developer-focused remediation guidance. You will help strengthen secure software delivery practices by integrating automated scanning into CI/CD pipelines and collaborating directly with agency development teams.
Compensation: USD 75,000 - 135,000 per year.
Work location: Brooklyn, NY (onsite).
Experience: Minimum 4 years of relevant full-time experience.
Education: Baccalaureate degree from an accredited college.
What you’ll do
- Execute application security assessments within the Software Security Assurance Program (SSAP) to confirm that web applications, APIs, and mobile systems meet city security standards prior to deployment.
- Run SAST, DAST, and manual security reviews to validate vulnerabilities, reduce false positives, and prioritize findings by operational risk.
- Use Software Composition Analysis (SCA) tools to monitor open-source and third-party component vulnerabilities, track issues, and drive remediation.
- Perform structured threat modeling and logic reviews for assigned applications during the design phase to identify security flaws before code is written.
- Act as a technical point of contact for agency development teams, providing clear and actionable remediation guidance and secure coding advice.
- Assist with configuring and integrating automated security scanning tools into agency CI/CD pipelines (examples include GitHub Actions, Azure DevOps, and GitLab) to support DevSecOps practices.
- Review third-party vendor solutions and web APIs (including OAuth and REST) to verify alignment with city security policies and industry best practices.
- Contribute to secure coding guidelines, application security documentation, and training materials for agency development staff.
Qualifications
- A baccalaureate degree from an accredited college and four years of satisfactory full-time experience related to projects and policies required for the position; or education and/or experience equivalent to this requirement.
- 2–4 years of dedicated professional experience in application security, penetration testing, or software engineering with a focus on application security.
- Hands-on experience configuring, operating, and tuning SAST, DAST, and SCA tools (examples include Veracode, Checkmarx, Snyk, and Burp Suite) and working with CI/CD pipelines.
- Strong practical knowledge of OWASP Top 10, CWE flaw types, manual vulnerability verification, and secure coding concepts in common languages such as Python, Java, JavaScript/TypeScript, or C#/.NET.
- Working knowledge of web API security principles (including REST and OAuth 2.0) and basic application security controls in cloud environments such as AWS, Azure, or GCP.
- Experience conducting application threat modeling and architectural flaw reviews.
- Strong verbal and written communication skills, including the ability to explain technical vulnerabilities and remediation steps to developers and project teams.
- Mid-level application security or testing certifications are a plus (examples include GIAC GWAPT, GWEB, eWPT, CompTIA PenTest+, or CSSLP).
Required technologies and concepts
SAST, DAST, SCA, Software Composition Analysis (SCA), SSAP, Veracode, Checkmarx, Snyk, Burp Suite, GitHub Actions, Azure DevOps, GitLab, OAuth, REST, OAuth 2.0, AWS, Azure, GCP, Python, Java, JavaScript/TypeScript, C#/.NET, OWASP Top 10, CWE.
Work schedule
Due to the technical duties of this role in a 24/7 operation, the candidate may be required to work various shifts, including weekends and/or nights/evenings.
Additional information
To apply: Interested applicants with other civil service titles who meet the preferred requirements should also submit a resume for consideration.
Public Service Loan Forgiveness: As a prospective employee of the City of New York, you may be eligible for federal loan forgiveness programs and state repayment assistance programs. For more information: https://studentaid.gov/pslf/.
Residency requirement: New York City Residency is not required for this position.
The City of New York is an inclusive equal opportunity employer committed to recruiting and retaining a diverse workforce and providing a work environment free from discrimination and harassment based on any legally protected status or protected characteristic, including sex, race, color, ethnicity, national origin, age, religion, disability, sexual orientation, veteran status, gender identity, or pregnancy.
