Hands-On Application Security Engineering

• Perform hands-on security analysis of applications, services, APIs, and supporting components.
• Work directly in Java, Python, and Go codebases to identify security weaknesses, understand root cause, and recommend practical remediation.
• Conduct manual secure code reviews of security-sensitive components and application changes.
• Partner directly with software engineers to troubleshoot vulnerabilities and develop secure solutions.
• Develop reusable secure coding patterns, controls, and automation that prevent recurring vulnerability classes.

Vulnerability Validation & Remediation

• Own application vulnerability remediation from initial finding through validation, prioritization, remediation, retesting, and closure.
• Personally reproduce and validate vulnerabilities rather than relying solely on scanner severity or external reports.
• Assess actual application risk using factors such as exploitability, code reachability, application exposure, data sensitivity, business criticality, and compensating controls.
• Work with development teams to explain findings, identify root cause, and determine the appropriate remediation.
• Drive systemic fixes rather than repeatedly addressing individual instances of the same vulnerability.
• Maintain clear remediation SLAs and escalate unresolved Critical and High findings when appropriate.

Secure Development Lifecycle

• Help define and mature security gates and review checkpoints throughout the SDLC.
• Embed security requirements into architecture, design, sprint, and release processes.
• Integrate preventative security controls into developer workflows and CI/CD pipelines.
• Partner with Engineering to make secure development practices practical and scalable.

SAST, DAST & Software Composition Analysis

• Operate, configure, and tune SAST, DAST, and SCA tooling to produce actionable developer findings.
• Investigate scanner output and distinguish meaningful security risk from false positives and low-risk findings.
• Evaluate software dependency vulnerabilities using application context, including reachability, vulnerable-function usage, exploitability, and remediation options.
• Partner with developers on dependency upgrades, replacement strategies, exceptions, and compensating controls.
• Improve security automation and feedback within CI/CD workflows.

Threat Modeling & Secure Design

• Threat-model new features and significant architectural changes before code is written.
• Review designs for authentication, authorization, trust boundaries, data flows, cryptographic controls, and abuse scenarios.
• Use methodologies such as STRIDE, PASTA, or equivalent approaches.
• Translate threat-model findings into practical engineering requirements and security controls.

API & Cloud-Native Security

• Review application and API security controls including authentication, authorization, OAuth 2.0/OIDC, mTLS, rate limiting, and abuse prevention.
• Partner with teams building cloud-native applications in AWS, Kubernetes/EKS, containers, and Linux/Ubuntu environments.
• Evaluate application security risks across distributed services and cloud-native architectures.

Developer Enablement

• Build strong working relationships with Engineering and operate as a technical partner rather than a security gatekeeper.
• Provide developers with clear, actionable remediation guidance.
• Deliver secure-coding guidance and training based on real vulnerabilities and recurring patterns.
• Help develop and mature a Security Champions program across development teams.
• Create runbooks, standards, and secure-development patterns teams can use independently.

Application Security Testing

• Validate application and API vulnerabilities through hands-on testing when needed.
• Coordinate external penetration-testing engagements, validate reported findings, and drive remediation.
• Hands-on application or API penetration-testing experience is strongly preferred.