Staff Application Security Engineer (R5949)

Required

• 7+ years of experience in application security, product security, DevSecOps, secure software engineering, cybersecurity engineering, or a closely related field.
• Demonstrated experience designing, implementing, or maturing a secure SDLC or application-security program across multiple engineering teams.
• Strong working knowledge of secure coding practices, application-security testing, vulnerability management, software delivery, and DevSecOps principles.
• Experience working directly with developers to explain findings, guide remediation, and improve secure-development practices.
• Hands-on experience with SAST, DAST, SCA, dependency vulnerability management, secrets scanning, and related application-security tooling.
• Experience integrating security controls into source-control, CI/CD, build, release, and deployment workflows.
• Experience performing or facilitating threat modeling, security design review, architecture review, or security requirements definition.
• Knowledge of common application-security risks, including authentication, authorization, API security, insecure deserialization, injection vulnerabilities, insecure dependency use, secrets exposure, and business-logic vulnerabilities.
• Experience with software supply-chain security concepts, including SBOMs, dependency provenance, build integrity, artifact signing, release attestations, and secure artifact management.
• Experience with open-source software risk management, including vulnerable dependencies, transitive dependencies, license obligations, and governance processes.
• Familiarity with NIST SP 800-218 / SSDF, OWASP SAMM, SLSA, or comparable secure-development and supply-chain security frameworks.
• Ability to read and assess production code and scripts in one or more modern programming languages.