Application Security Enablement Engineer

About the role

This is an Application Security role focused on driving enterprise application security standards across applications, platforms, and cloud environments. You will enable automation for vulnerability detection, remediation, exception review and reporting to improve efficiency and consistency, while providing actionable, risk-based technical guidance and training to developers on secure design and coding standards.

Key responsibilities

• Help drive adoption of enterprise application security standards across applications, platforms, and cloud environments

• Enable automation for vulnerability detection, remediation, exception review and reporting to improve efficiency and consistency

• Provide actionable, risk-based technical guidance and training to developers on secure design and coding standards (e.g., OWASP)

• Partner with architects, product owners, and development teams during design and planning phases to embed secure-by-design principles

• Conduct and validate application security testing (automated and manual), including intake and validation of findings from external penetration tests and bug bounty programs

• Support vulnerability management processes, including triage, exception review, remediation, and reporting

• Conduct application and architecture-level Threat Modeling for new applications, major enhancements, and high-risk changes

• Support uplift of Threat Modeling maturity by defining templates, playbooks, and reusable threat libraries for common platforms and patterns

• Partner with development teams to integrate security expectations into CI/CD pipelines and DevSecOps workflows

• Validate and contextualize findings from automated tools, penetration tests, and external assessments where design-level issues are identified

About you

• Minimum 5+ years in application security or software development roles with a focus on secure coding and DevSecOps

• Strong understanding of application security principles, SDLC, and CI/CD pipelines

• Strong understanding of application penetration testing

• Knowledge of secure coding standards and frameworks (e.g., OWASP Top 10, NIST)

• Excellent collaboration and communication skills to engage developers and stakeholders

• Hands-on experience with security tools (e.g., Secrets, SCA, SAST, Container security, DAST) and automation frameworks

• Familiarity with cloud-native application security concepts

• Certifications: OSCP, CISSP or preferred equivalent

• Practical exposure to API security, Kubernetes and container platforms, Infrastructure as Code (IaC), hybrid cloud environments, and penetration testing or vulnerability scanning toolchains