Web Application Security

Web Application Security Engineer Jobs

2 jobs found

Today

Cybersecurity Engineer

Delta Defense, LLC West Bend, WI

West Bend, WI

Today

$100k - $125k/yr Full time Ai Security Api Security Application Security

Apply Now

Job Description

Delta Defense, LLC is building a modern security engineering program that spans product engineering, cloud infrastructure, and analytics teams. In this role, you will help design and evolve security controls across application and web/API security, offensive security, AI security and governance, incident response and detection, vulnerability management, and security automation.

This onsite position is based in West Bend, WI, and the target salary range is USD 100,000 - 125,000 per year. Delta Defense is seeking a cybersecurity engineer with 3+ years of experience to partner across Engineering, DevOps, Infrastructure, and Product.

Responsibilities

Lead application security throughout the software development lifecycle by partnering with Engineering and DevOps to integrate security into design, development, testing, and deployment.
Conduct threat modeling, secure design reviews, and code reviews, and implement automated SAST, DAST, SCA, and secrets detection in CI/CD pipelines.
Design, implement, and continuously improve web application and API security controls across the enterprise.
Develop and tune WAF policies, perform API security assessments, identify business logic vulnerabilities, and define secure-by-design standards that reduce risk without unnecessarily slowing developer velocity.
Plan and execute penetration testing against web applications, APIs, cloud environments, and supporting infrastructure.
Validate vulnerabilities through manual testing, prioritize findings by business risk, and work with engineering teams to ensure timely remediation and measurable risk reduction.
Develop and enforce security controls governing enterprise AI platforms and internally developed AI capabilities.
Establish policies for data classification, model usage, access controls, audit logging, and secure AI integrations to support responsible adoption.
Perform security assessments of Retrieval-Augmented Generation (RAG), agentic AI systems, MCP integrations, and large language model applications.
Identify and mitigate AI and application risks including prompt injection, indirect prompt injection, insecure tool use, excessive agent permissions, model abuse, and data leakage using guidance such as OWASP LLM Top 10 and MITRE ATLAS.
Support security incident investigation and response, including threat analysis, digital forensics, containment, eradication, and root cause analysis.
Operate a risk-based vulnerability management program that prioritizes remediation based on exploitability, business impact, and threat intelligence rather than scanner severity alone.
Measure remediation effectiveness, track risk reduction, and ensure alignment to frameworks including NIST CSF, CIS Controls, OWASP, PCI DSS, and organizational security standards.
Help maintain secure cloud environments across AWS, Google Cloud, and DigitalOcean.
Design and implement cloud security architecture covering IAM, Kubernetes security, container security, Infrastructure-as-Code security scanning, secrets management, workload protection, and Zero Trust network controls.
Build security automation to improve operational efficiency and security outcomes using scripting, APIs, Infrastructure as Code, and AI-assisted workflows.
Develop integrations between security platforms, automate repetitive security processes, and use AI responsibly to enhance detection, investigation, and response while maintaining governance and oversight.
Serve as a trusted technical advisor across Engineering, Infrastructure, and Product teams by providing security guidance, mentoring engineers, evaluating emerging technologies, and translating security risks into practical engineering solutions.
Continuously research evolving threats, techniques, and defensive capabilities to improve the organization’s security posture.

Requirements

Deep cybersecurity engineering capability across application security, cloud and infrastructure security, data platform security, detection engineering, and vulnerability management, with practical experience securing modern cloud-first environments and large-scale SaaS and data platforms.
Hands-on application security experience with SAST, DAST, SCA, secure code review, API security, WAF tuning, threat modeling, CI/CD security, and secrets management using tools such as Doppler, Semgrep, Snyk, Burp Suite, OWASP ZAP, Cloudflare, HashiCorp Vault, or equivalents.
Proficiency in at least one programming or scripting language and the ability to read, write, and exploit code in a security context; Python, JavaScript, PHP, Golang, or Rust preferred.
Working knowledge of AI security risks and controls including prompt injection, indirect prompt injection, model abuse, data leakage, agentic workflow vulnerabilities, OWASP LLM Top 10, MITRE ATLAS, and emerging AI security tooling.
Practical cloud and infrastructure security experience across DigitalOcean, AWS, GCP, Kubernetes, IAM, CSPM, IaC scanning, container security, zero-trust/SASE architectures, and security tooling such as EDR, SIEM, CASB, SWG, DLP, IDS/IPS, and PAM.
Ability to communicate risk clearly in business terms, influence cross-functional stakeholders without direct authority, and stay decisive during active incidents while driving remediation to closure and demonstrating Delta Defense’s core values.
Bachelor’s degree in Computer Science, Information Security, Cybersecurity, Information Technology, or a related field preferred; equivalent work experience and relevant certifications may be considered in lieu of a degree.
Minimum 3 years of cybersecurity engineering experience working closely with application, software, data engineering, DevOps, cloud, infrastructure, or security operations teams.
Experience securing applications, APIs, cloud platforms, CI/CD pipelines, Kubernetes environments, data platforms, and modern engineering ecosystems using technologies such as JavaScript, PHP, PostgreSQL, Kafka, NeonDB, GitLab, Python, Snowflake, dbt, Fivetran, Databricks, Tableau, Informatica, Kestra, or related technologies.
Strong understanding of security frameworks and control models including NIST CSF, CIS Controls, PCI DSS, Cyber Defense Matrix, ISO 27001, OWASP, and MITRE ATT&CK.
Preferred certifications include CCSP, CASP+, Security+, CEH, GPEN, GWAPT, or other relevant cloud, application security, AI security, offensive security, or security engineering certifications.
Must be authorized to work in the United States without current or future sponsorship.

Benefits

Target Salary Range: $100,000 - $125,000
Eligible for Company Incentive Bonus

Working Conditions

Remote or Hybrid

Learn more & apply: https://www.deltadefense.com/careers

View full job page →

2d ago

Application Security Engineer

Veilant Tysons, VA

Tysons, VA

2d ago

$115k - $145k/yr Full time Application Security Code Security Cybersecurity Tools

Apply Now

Job Description

Veilant is hiring an Application Security Engineer in Tysons, VA (onsite) to help validate, secure, and continuously improve software delivered by internal and partner engineering teams. In this role, you will work close to development teams while strengthening security through release reviews, threat modeling, secure coding feedback, and DevSecOps tooling improvements. The position offers a salary range of $115,000 to $145,000 annually, plus a benefits package designed to support your health, learning, and day-to-day comfort.

Why you’ll like working here

Flexible PTO + holidays
401k match benefit up to 10%, with an automatic 3% safe harbor contribution and additional matching based on employee contributions
Medical (HSA & PPO Plans Available), dental, vision, disability, and life insurance
Employer contribution to HSA
Learning & Development opportunities
Professional coaching services
Get the technology you want to do your job
Free daily snacks & drinks

Responsibilities

Audit major and minor software release cycles to intercept and remediate security flaws before deployment
Review source code to identify, isolate, validate, and contextualize vulnerabilities in complex application codebases
Build safe proof-of-concept examples to demonstrate exploitation paths and verify real-world impact
Contextualize findings using application business logic, user workflows, data sensitivity, and production use cases
Author clear remediation guidance and partner with development teams to implement patches, controls, or architectural mitigations
Intercept and analyze application-layer network traffic using tools such as Burp Suite or similar intercepting proxies
Assess and help secure core architectures across REST APIs, SQL databases, PostgreSQL, JWT/OAuth, identity providers, and token-based authentication mechanisms
Perform threat modeling for web applications based on use cases, data flows, user roles, trust boundaries, and production environments
Improve DevSecOps pipelines by integrating, tuning, and operationalizing SAST, DAST, SCA, IaC scanning, secrets detection, and container security tooling
Support container runtime security using monitoring and runtime protection tools such as Falco, NeuVector, or similar technologies
Create standardized security reporting that translates technical findings into clear risk narratives for both engineering teams and executive stakeholders
Build and maintain a repeatable AppSec review process for major and minor software releases
Integrate and improve SAST, DAST, and SCA checks in CI/CD pipelines to make security testing a reliable part of the development lifecycle
Establish threat modeling practices using common frameworks and apply them to Veilant’s Angular front-end, Java Spring Boot back-end, REST APIs, SQL databases, and authentication flows
Improve secure coding practices through feedback, remediation guidance, and collaborative reviews
Implement container runtime security best practices including visibility, monitoring, and runtime protections for containerized workloads
Write standardized security reports that communicate risk, impact, and remediation steps for both executive-level stakeholders and engineering teams

Requirements

Ability to obtain a Security Clearance
2+ years of software development experience in Java
Hands-on experience reviewing or securing applications built with Java Spring Boot, Angular, REST APIs, SQL databases, and PostgreSQL
Working knowledge of authentication and authorization technologies including JWT, OAuth, identity providers, Entra, Keycloak, and token-based access models
Experience intercepting, decrypting, manipulating, and analyzing web or application network traffic
Demonstrated ability to find, validate, and explain vulnerabilities in a real codebase
Familiarity with CI/CD tools such as GitLab CI, Azure DevOps, or GitHub Actions
Experience with containerized environments and orchestration tools such as Kubernetes
Exposure to infrastructure-as-code and container scanning tools such as Trivy, Kubesec, or similar technologies
Understanding of cloud hosting environments such as Azure or AWS
Familiarity with secrets management tools such as GitLab Secrets Manager, AWS KMS, Azure Key Vault, or Ansible Vault
Experience with automated application security testing including SAST, DAST, and SCA
Familiarity with runtime security and monitoring tools for containers such as Falco, NeuVector, or similar platforms
Hands-on web security testing experience using Burp Suite or comparable tooling
Strong written communication skills, including the ability to write reports for both technical and non-technical audiences
OSWE, OSCP, and/or GXPN certifications are highly desirable

Physical requirements

Must be able to remain in a stationary position 50% of the time; occasionally move about inside the office
Constantly work with computers and other information technology equipment
Ability to communicate information and ideas in a classroom style format; may stand at a podium for long periods of time

View full job page →

Web Application Security Engineer Jobs

Cybersecurity Engineer

Application Security Engineer

Get Web Application Security Engineer Jobs alerts