application security engineer

Virtu Thinko

<p><i><b>JOB DESCRIPTION </b></i></p><p><b>Application Security Engineer</b></p><p><i><b>Department:</b></i></p><p>Technologies &ndash; Infrastructure</p><p><i><b>Reports to: </b></i></p><p>Security Operations Manager</p><p><b>1. Position Summary</b></p><p>The Application Security Engineer is responsible for safeguarding the organization&rsquo;s application landscape by embedding security into every step of the software development lifecycle (SDLC). The role requires a deep understanding of application security principles, penetration testing, threat modelling, secure coding practices, and modern DevSecOps methodologies.</p><p>The ideal candidate will work closely with development, project teams, and broader technology functions to proactively identify vulnerabilities, conduct in‑depth security assessments, and implement preventative controls. The role demands hands‑on experience with SAST/DAST tools, application penetration testing, API security, and the ability to integrate security controls within CI/CD pipelines.</p><p>This position operates in a fast‑paced environment requiring strong technical expertise, excellent communication skills, and the ability to translate complex security findings into actionable remediation guidance. The successful candidate will play a critical role in maturing the organization&rsquo;s application security posture and ensuring compliance with industry best practices and global security standards.</p><p><b>Responsibilities:</b></p><p>&middot; Integrate security into all phases of the SDLC by collaborating with development, QA, project, and architecture teams.</p><p>&middot; Conduct comprehensive application security assessments, including manual and automated code reviews, DAST/SAST analysis, and penetration testing for web, mobile, and API-based applications.</p><p>&middot; Perform design and architecture reviews, including threat modelling using frameworks such as STRIDE and PASTA.</p><p>&middot; Identify vulnerabilities and provide remediation guidance aligned with secure coding standards and frameworks such as OWASP Top 10, OWASP ASVS, NIST 800‑115, and CWE.</p><p>&middot; Develop and maintain application security policies, secure coding guidelines, and best practice references.</p><p>&middot; Support integration of security tooling into CI/CD pipelines.</p><p>&middot; Review and improve security processes, focusing on optimization and automation opportunities.</p><p>&middot; Conduct cloud and infrastructure penetration tests when required, in coordination with infrastructure teams.</p><p>&middot; Manage and validate vulnerability findings using enterprise vulnerability management systems.</p><p>&middot; Assist development teams in debugging and resolving security vulnerabilities, ensuring timely remediation.</p><p>&middot; Participate in incident response activities related to application-layer attacks.</p><p>&middot; Maintain up‑to‑date knowledge of emerging threats, exploit techniques, and evolving security technologies.</p><p>&middot; Provide clear technical documentation, reports, and executive summaries of assessment results.</p><p>&middot; Support internal audits, compliance requirements, and risk assessments related to application security.</p><p>&middot; Promote secure-by-design principles and contribute to the organization&rsquo;s DevSecOps strategy.</p><p>&middot; Ensure full compliance with Information Security and Assurance policies, industry standards, and applicable regulatory requirements by embedding governance and controls across the application lifecycle.</p><p>&middot; Develop, maintain, and enforce application and system hardening baselines aligned with CIS Benchmarks and other security configuration standards.</p><p>&middot; Participate in 24&times;7 support during critical application security incidents, investigations, and urgent remediation activities as required.</p><p>&middot; Contribute to security-related initiatives and projects, performing additional duties as assigned to support evolving business and technology needs within the security program.</p><p><b>Required Experience </b></p><p>&middot; 5-7 years of professional experience in application security, penetration testing, or related security engineering roles.</p><p>&middot; Demonstrated hands‑on experience in application penetration testing using tools such as Burp Suite, OWASP ZAP, and related exploitation frameworks.</p><p>&middot; Strong knowledge of OWASP Top 10, OWASP ASVS, OWASP SAMM, and secure SDLC frameworks.</p><p>&middot; Experience performing threat modelling and reviewing application architecture designs.</p><p>&middot; Hands‑on expertise with SAST/DAST tools and integrating them into CI/CD workflows.</p><p>&middot; Working knowledge of vulnerability management process and tools.</p><p>&middot; Practical experience reviewing code in languages such as JavaScript, TypeScript, Java, or similar.</p><p>&middot; Good understanding of microservices, REST APIs, authentication/authorization mechanisms, and modern application frameworks.</p><p>&middot; Basic scripting proficiency (Python, Bash, or PowerShell).</p><p>&middot; Familiarity with container security, cloud-native security concepts, and DevSecOps practices.</p><p>&middot; Understanding of networking, TCP/IP fundamentals, and common attack vectors.</p><p><b>Education:</b></p><p>&middot; BSc/BA in Computer Science, Cybersecurity, Information Technology, or equivalent professional experience.</p><p><b>Industry Qualifications: </b></p><p>&middot; OSWE, OSCP, OSWA, GPEN, GWAPT, GCPN, or similar security certifications.</p><p>&middot; Certifications in secure coding, cloud security, or application security standards.</p><p>&middot; DevSecOps‑related certifications are an advantage.</p><p><b>Key Behaviours / Competencies</b></p><p>&middot; Strong analytical and problem‑solving skills with attention to detail.</p><p>&middot; Ability to work independently, prioritize workload, and meet defined deadlines.</p><p>&middot; Excellent communication skills, with the ability to explain technical vulnerabilities to non‑technical stakeholders.</p><p>&middot; Demonstrated ability to operate effectively in high‑pressure environments.</p><p>&middot; A mindset focused on continuous improvement, innovation, and automation.</p><p>&middot; Strong collaboration and teamwork skills across multidisciplinary teams.</p><p>&middot; Ability to evaluate applications from both attack and defense perspectives.</p><p>&middot; Demonstrate a customer‑first mindset by enabling secure, frictionless digital experiences.</p><p>&middot; Balance security requirements with business needs to support secure innovation.</p><p>&middot; Provide clear, empathetic, and actionable guidance to internal stakeholders.</p><p>&middot; Ensure security processes support transparency, agility, and minimal disruption to delivery teams.</p><p><b>5. </b><b>Primary Contacts</b></p><p>o Information Security Team</p><p>o Development Leads / Testing Teams</p><p>o Project Managers</p><p>o Security Operations Center (SOC)</p><p>o Architecture &amp; Governance Team</p><p>o Internal and External Auditors</p><p>Job Types: Temporary, Contract<br/>Contract length: 12 months</p><p>Pay: BD1,000.000 - BD1,500.000 per month</p>

Application Security Engineer

Train With Ellie

<p></p><div><p><b>About </b><b>Owner.com</b></p><p>
Owner is the AI growth system for local restaurants.</p><p></p><p><br>
Our AI continuously improves SEO, marketing, and online ordering to grow first-party orders. Unlike other companies that force small business owners to master their software to drive sales, Owner gives them a proven system run by experts.</p><p></p><p><br>
Owner is like having an army of engineers and marketers on your side, just like the big chains.</p><p></p><p><b><br>
Our vision</b></p><p>
We&rsquo;re starting by helping independent restaurants succeed online.</p><p></p><p><br>
But it&rsquo;s not just restaurants that need our help. Most local businesses are struggling with these same problems. Huge technology corporations are taking their customers, bleeding their profits, and making it hard for them to survive.</p><p></p><p><br>
Once we nail the solution for restaurants &ndash; we&rsquo;ll scale it into every other local business type.</p><p></p><p><br>
In the future we envision, tens of millions of local business owners will use our technology to succeed in the digital age.</p><p></p><p><br>
Read our Series C memo here</p><p></p><p><b><br>
Our traction</b></p><p>
Since 2020, we've generated tens of millions in revenue and processed over half a billion dollars of online orders. 1 in 5 Americans have used an Owner.com website.</p><p></p><p><br>
More importantly, we&rsquo;ve helped over 20,000 restaurant owners, and saved them nearly $200 million in fees.</p><p></p><p><b><br>
Our team</b></p><p>
Our team is now in the low hundreds. We&rsquo;ve got top talent from the most successful companies in SMB software, including: Shopify, HubSpot, DoorDash, ServiceTitan, Rappi, Faire and Stripe.</p><p></p><p><br>
We&rsquo;ll be scaling even faster in 2026 to keep pace with our customer growth.</p><p></p><p><b><br>
Where we work</b></p><p>
Owner is a remote-first, global company headquartered in San Francisco, with a sales hub in Toronto. For a few of our roles we prioritize in-person collaboration at one of our office locations. Most of our teammates are distributed throughout the globe. Please review the role description and discuss with your recruiter for more details on location!</p><p></p><p><br>
Why we&rsquo;re looking for you</p><p>
We are seeking a highly skilled Application Security Engineer (AppSec Engineer). The AppSec Engineer will partner with engineering teams to conduct application security testing, remediation, and prevention across our entire product line. This role is critical to protecting and advancing Owner&rsquo;s mission.</p><p>
This role is 100% remote and can be based anywhere in the United States or Canada, as well as Mexico or Colombia.</p><p></p><p><b>
The impact you will have</b></p><p></p><ul><li><p>
Secure Owner&rsquo;s product line.</p></li><li><p>
Enable teams to move fast without exposing Owner to unnecessary risk.</p></li><li><p>
Protect our customers by helping prevent fraud and abuse across our products.</p></li><li><p>
Make Owner&rsquo;s development process more secure, efficient, and enjoyable.</p></li></ul><p></p><p><b>
Who you&rsquo;ll work with</b></p><p></p><ul><li><p>
This role has company-wide impact and works cross-functionally across the organization, including:</p></li><li><p>
Engineering teams</p></li><li><p>
Customer Support teams</p></li></ul><p></p><p><b>
What we&rsquo;re looking for</b></p><p></p><ul><li><p>
Exceptional application security testing capabilities.</p></li><li><p>
Conduct penetration testing for all applications, both existing and new developments.</p></li><li><p>
Perform on-demand security testing for new and existing applications.</p></li><li><p>
Conduct security code reviews in partner engineering teams and product teams.</p></li><li><p>
Experience working with and testing startups in this capacity.</p></li><li><p>
Triage reported vulnerabilities.</p></li><li><p>
Bonus: Background in bug bounty programs and exploit development.</p></li><li><p>
Experience writing feature-level, production-quality code using an object-oriented programming language.</p></li><li><p>
Flexible, pragmatic problem-solving approach.</p></li><li><p>
Strong written and verbal communication skills.</p></li><li><p>
Deep sense of personal ownership and accountability.</p></li><li><p>
Builder mentality.</p></li><li><p><b>
Nice to Haves</b></p></li><li><p>
Experience with B2C business models and their associated security considerations.</p></li><li><p>
Experience with application-level alerting and detection.</p></li><li><p>
Experience detecting and preventing fraud and abuse.</p></li><li><p>
Experience with payment or financial security.</p></li></ul><p></p><p><b>
Pay and benefits</b></p><p></p><ul><li><p>
The estimated base salary for this role is in the local equivalent of $190,000 to $220,000 USD</p></li><li><p>
Other benefits include comprehensive health coverage, remote-first work environment, unlimited PTO - plus extra fun perks!</p></li></ul><p></p><p><b><br>
   Notice - Employment Scams</b></p><p>
Communication from our team regarding job opportunities will only be made by an Owner team member with an @owner.com email address.</p><p>
We do not conduct interviews over email or chat platforms, and we will never ask you to provide personal or financial information such as your mailing address, social security number, credit card numbers or banking information. If you believe you are being contacted by scammer, please mark the communication as &quot;phishing&quot; or &ldquo;spam&rdquo; and do not respond.</p></div><div></div>

Oasys

<div><div><b>Who We Are: </b>Oasys International LLC (Oasys) is a fast-growing federal government contractor delivering high-quality technology consulting and professional services to civilian, defense, and homeland security agencies. We have been recognized on Inc. 5000&rsquo;s list of the fastest-growing companies in America for five consecutive years and named a Best Places to Work in Virginia for the past two years.</div><div></div><div><br>
Our success is driven by a talented team of technologists, consultants, engineers, and subject-matter experts who support complex federal missions with integrity and excellence. At Oasys, we foster a collaborative, merit-based culture that values continuous learning, professional growth, and work-life balance. We are committed to creating an inclusive, engaging environment where employees are recognized for their contributions and empowered to build meaningful, long-term careers.</div><div></div><div><b><br>
Position Summary:</b></div><div>
The <b>Application Security Engineer</b> position supports secure application development and cybersecurity operations for Federal DoD programs. The role requires a deep expertise in application security, software development, federal cybersecurity standards, and secure architecture. Will be responsible for senior-level leadership in information security, secure SDLC integration, and compliance with federal security frameworks such as NIST 800‑53, NIST 800‑37 RMF, FedRAMP, and agency-specific security baselines.</div><div></div><div><b><i><br>
NOTE: This role is contingent on the contract being awarded.</i></b></div><div></div><div><b><br>
Primary Responsibilities:</b></div><div><ul><li>
Serve as the primary application security SME for the project, ensuring compliance with NIST, FISMA, FedRAMP, DHS, DoD, and agency-specific security requirements.</li><li>
Guide system teams through Risk Management Framework (RMF) steps related to application security, including control implementation, evidence gathering, and POA&amp;M mitigation.</li><li>
Lead security architecture reviews for mission-critical systems, ensuring secure-by-design principles across federal systems and networks.</li><li>
Integrate security into the federal SDLC by defining secure coding standards, conducting code reviews, and providing architectural input.</li><li>
Conduct and lead advanced security testing.</li><li>
Provide CISSP-level expertise on risk evaluation, compensating controls, and secure architecture guidance.</li><li>
Guide enterprise risk posture by advising leadership on vulnerabilities, mitigations, and long-term remediation planning.</li><li>
Ensure secure configurations of cloud resources within AWS GovCloud FedRAMP environments.</li><li>
All other duties as assigned by management.</li></ul></div><div></div><div><b><br>
Skills and Qualifications:</b></div><div><ul><li>
Bachelor&rsquo;s degree in computer science or related field</li><li>
10 years in application development and IT security</li><li>
Experience performing risk assessments for Federal systems in AWS GovCloud</li><li>
Experience supporting FedRAMP High/Moderate systems</li><li>
Knowledge in Java, Python, HTML, SQL, CSS and cloud computing</li><li>
Excellent communication and management skills.</li></ul></div><div></div><div><b><br>
Certifications Required:</b></div><div><ul><li>
Certified Secure Software Lifecycle Professional (CSSLP)</li><li>
Certified Information Systems Security Professional (CISSP)</li><li>
CompTIA Security +</li></ul></div><div></div><div><b><br>
Certifications Preferred:</b></div><div><ul><li>
Certified Ethical Hacker (CEH)</li></ul></div><div></div><div><b><br>
Security Clearance Requirements:</b></div><div><ul><li>
Must be a U.S. Citizen</li><li>
Must have an active DoD Secret clearance.</li></ul></div><div></div><div><b><br>
Work Location:</b></div><div><ul><li>
Fairfax, VA &ndash; Corporate Headquarters (Hybrid)</li></ul></div><div></div><div><b><i><br>
Oasys is proud to be an equal opportunity employer for all protected groups, including protected veterans and individuals with disabilities.</i></b></div></div>

البنك التجاري الدولي

<div></div><div><div>Description<div></div><p><br>
JOB PURPOSE:<br>
To deploy, operate, ensure and maintain the appropriate application and software security solutions, controls and tools within the overall bank&rsquo;s approved security architecture framework and according to bank&rsquo;s information security policies, procedures and guidelines.</p>
<p>Description<br>
1.Monitor, Define, Implement and operate the enterprise applications security platforms, Public Key Infrastructure (PKI), and assist in fixing the vulnerabilities / gaps identified from security scanning tools and services in order to provide the required assurance that corporate applications and published services are up and running in a secured way according to bank&rsquo;s information security policies.<br>
2.Run static code scanning tools and perform manual code inspection in alignment with IT Development team, while providing Information Security Compliance team with a clean report to provide assurance that secure code practices are being followed.<br>
3.Provide the required level of support for all managed systems and applications from application security perspective, acting as a focal point between Information Security Compliance team and the remaining IT stakeholders for any required security assessments. in order to maintain business operations and security controls according to approved service level agreement and information security standards.<br>
4.Participate in dynamic code scanning, application security design reviews and penetration testing of internal web applications and external partner applications to mitigate the identified vulnerabilities and security defects.<br>
5.Supports the implementation and enforcement of technical security measures on the application level according to policies, standards, and patterns of Information Security, in order to be fully aligned with corporate approved Secure Software Development Lifecycle.<br>
6.Participate in security architecture reviews for different applications as part of the BRD, Projects and SDLC process lifecycle to ensure effective security controls over enterprise applications as well as mitigation of reported vulnerabilities as security defects.<br>
7.Serves as a Subject Matter Expert (SME) in web application security for enterprise projects during development phases to provide security consulting and recommendations and assist in implementing and fine-tuning the different security controls in alignment with the business applications&rsquo; functionalities such as the Web Application Firewall (WAF) and the Next Generation Firewalls&rsquo; (NGFW) policies and access lists.<br>
8.Perform security functional testing as needed and validate pen-test findings, in order to provide information security by the required levels of assurance that identified security gaps and vulnerabilities have been mitigated as planned.<br>
9.Ensure proper configuration and functionality of the managed solutions and coordinate with support vendors for resolving issues impacting solutions&rsquo; availability, in order to keep solution with full compliance of current environment architectural and incident response requirements.<br>
10.Ensure that all implemented projects meet application security best practice, and guidelines, including but not limited to integration of third party security products within the current infrastructure, in order to ensure solution proper implementation and operation.<br>
11.Produce regular monthly KPIs, application security reports and dashboards for incidents identified on managed platforms, actions taken and mitigations applied for further reporting in order to be represented to the respective stakeholders/committees as needed.<br>
12.Support and Assist security related infrastructure/information Security teams in the estimation of implementation project time and materials, testing and evaluation of new technologies and security controls, in order to effectively optimize organization resources.<br>
13.Provide project management support by facilitating demonstrations of vendor partner products, reviewing and co-authoring statements of work, evaluation support for product demos, in order to ensure effective engagement towards business objectives.<br>
14.Ensure that application security tools and technologies are deployed in the current environment in line with architectural requirements with the appropriate levels of application security controls and systems monitoring at all levels, in order to ensure effective controls according to business/compliance/regulation requirements.<br>
Policies, Processes and Procedures<br>
15.Follow all relevant department policies, processes, standard operating procedures and instructions so that work is carried out in a controlled and consistent manner.<br>
Day-to-day operations<br>
16.Follow the day-to-day operations related to own jobs in the IT Security, Control &amp; Quality Assurance department to ensure continuity of work.<br>
Compliance<br>
17.Comply with all relevant CBE regulations, banking laws, AML regulations and internal CIB policies and code of conduct in order to maintain CIB&rsquo;s sound legal position and mitigate any potential risks.</p><p><br>
</p>
</div><div></div><div>Qualifications<div></div><p><br>
QUALIFICATIONS, EXPERIENCE, &amp; SKILLS<br>
 Bachelor&rsquo;s degree of Engineering, Computer Science or equivalent.<br>
 Senior Engineer: Minimum of 6 &ndash; 8 years of experience in IT Security and related disciplines.<br>
 Experience in use of various commercial and open source penetration testing tools and methodologies and performing penetration testing of web applications and operating systems.<br>
 Experience in identifying and remediating common web application vulnerabilities such as OWASP Top 10.<br>
 Familiarity with APT attack and kill chains.<br>
 Experience with enterprise security architecture and software such as Web Applications Firewalls, Next Generation Firewalls, email sandboxing, etc<br>
 Experience in configuring and implementing technical security solutions, application security platforms, sandboxing, and similar technologies.<br>
 Good written and verbal communication skills<br>
 Self-motivated, Problem Solving Skills, Detail oriented<br>
 Proven analytical and problem-solving abilities<br>
 Ability to effectively prioritize and execute tasks in a high-pressure environment<br>
 Experience working in a team-oriented, collaborative environment<br>
 Good command of English language.<br>
Recommended Certifications<br>
 Microsoft Certified Systems Administrator: Security<br>
 GIAC Information Security Fundamentals<br>
 CCNP Security</p><div><br>
</div></div><div>
Primary Location: Egypt-Giza-SMART VILLAGE BLDG. 1</div><div>
Work Locations: B219 - Financial District, Smart Village, Cairo - Alex Desert Road</div><div>
Job: Back Office</div><div>
Organization: FINANCE, STRATEGY, OPERATIONS &amp; TECHNOLOGY</div><div>
Shift: Day Job</div><div>
Job Type: Full-time Employee</div></div>

APPLICATION SECURITY ENGINEER

Shutterfly

<p></p><div><p>At Shutterfly, we make life's experiences unforgettable. We believe there is extraordinary power in the self-expression. That's why our family of brands helps customers create products and capture moments that reflect who they uniquely are.</p><br>
This is an exciting time for Shutterfly and we are looking for a Senior Application Security Engineer to join our team! In this position you will be an integral part of a developing and expanding Application Security program. The Senior Application Security Engineer is a vital role that helps to provide assurance for Shutterfly's critical applications and securely enables business functions. We're looking for a person who is just as passionate about uncovering a security vulnerability as you are about educating developers on how to fix it. Your focus will be on helping to build and maintain an Application Security program that can be used as the benchmark for our industry.
<p>What You'll Do Here:</p><br>
<ul><li>
Manage our bug bounty program including triage, assessing impact, risk scoring (CVSS), helping to locate the vulnerable code, providing mitigation guidance, performing thorough re-testing, and refining program policy and scope as needed.</li><li>
Vulnerability Management: Identify, triage, and remediate application vulnerabilities (SAST, SCA, IAST) using automated tools or manual testing.</li><li>
Web Penetration Testing: assisting with internal web pen tests and coordinating with 3rd party testers.</li><li>
Threat Modeling &amp; Risk Assessment: Lead threat modeling exercises and perform risk assessments for new and existing applications.</li><li>
Incident Response: Collaborate with incident response teams to investigate and remediate application-related security incidents.</li><li>
Security Tooling: Evaluate, implement, maintain and decommission security tools and platforms to support application security efforts (SAST, SCA, DAST, IAST, RASP, WAF, ASPM, CNAPP, CSPM).</li><li>
Continuous Improvement: Keep up-to-date knowledge of relevant security threats, mitigations and security best practices.</li><li>
Secure SDLC: Define and implement secure development practices, including code reviews, static/dynamic analysis, and CI/CD pipeline integration.</li><li>
Provide guidance and recommendations to software engineering teams to implement effective security measures to mitigate risks.</li><li>
Become a Subject Matter Expert and top technical resource to engineers around the organization. Help engineers reproduce vulnerabilities, understand their impact, document issues, mitigate or retest the effectiveness of a fix, etc.</li><li>
Perform and lead code reviews of critical PRs and code changes.</li><li>
Security Architecture &amp; Design: Partner with engineering teams to design secure systems and applications, ensuring security is built-in from the ground up. Initiate and lead design, architecture, and solution reviews.</li><li>
Mentorship &amp; Leadership: Mentor junior security engineers and developers on secure coding practices and security principles. Build relationships with stakeholders and business leaders across the organization.</li><li>
Cross-Functional Collaboration: Work closely with product, engineering, DevOps, and compliance teams to align security with business goals.
</li></ul><p>Required Qualifications:
</p><ul><li>Bachelor's degree in computer science, cybersecurity, or related technical field.
</li><li>Proficient in one modern programming language (preferably Java) and can review code in most major languages.
</li><li>Strong analytical and problem-solving abilities with a risk-based security approach.
</li><li>Advanced user of Burp Suite Pro, bonus if you have created custom extensions in Java or Python and have used or modified existing extensions.
</li><li>Excellent communication and collaboration skills, able to work across IT, engineering, and business teams.
</li></ul><p>Preferred Qualifications:
</p><ul><li>Full stack web development experience within an active security program.
</li><li>Experience managing a bug bounty program.
</li><li>Have a security certification that demonstrates proficiency in web assessments, secure coding, and professional report creation (For example: OSWA, OSWE, GWAPT, GWEB).
</li><li>Submitted reports to bug bounty programs or VDPs, and you've found a CVE along the way.
</li><li>Strong command-line and scripting skills (bash, zsh, Python) on Linux and Mac.
</li><li>Enjoy attending security conferences and occasionally participate in CTFs.
</li><li>Spend time on cyber security training platforms (HackTheBox, TryHackMe).
</li><li>Work with engineering teams to develop secure code libraries.
</li><li>Experience deploying and managing a RASP solution (e.g. Contrast, Prevoty) on multiple tech stacks.
</li><li>Capable of rapidly learning and integrating emerging tools and platforms with minimal supervision.
</li></ul><p>Supporting a diverse and inclusive workforce is important to Shutterfly not only because it directly reflects our value of Embracing our Differences, but also because it's the right thing to do for our business and for our people. We welcome all applicants and evaluate them based on their qualifications. Learn more about our commitment to Diversity, Equity, and Inclusion on our Career Site.</p><p>
The compensation package for this role is based on multiple factors, such as job level, responsibilities, location, and candidate experience. The base pay ranges included below are specific to the locations listed, and may not be applicable to other locations.</p><p>
California : [$128,000-181,250]</p><p>
Connecticut and New York: [$128,000-165,750]</p><p>
Colorado, Illinois, Minnesota and Washington: [$128,000-153,000]</p><p>
Nevada: [$120,250-165,750]</p><p>
Maryland and New Jersey: [$138,250-165,750]</p><p>
Hawaii : [$120,250-144,750]</p><p>
This position may be eligible for a bonus incentive, health benefits, a 401K program, and other employee perks. More details about our company benefits can be found at https://shutterflyinc.com/benefits/.</p><p>
This opportunity can be remote, but candidates must reside in a state in which Shutterfly is registered to do business. This includes all US states except District of Columbia, North Dakota, Mississippi, Rhode Island, Vermont, and Wyoming.</p><p>
This position will accept applications on an ongoing basis until filled.</p><p>
#SFLYTechnology</p></div>

Senior Application Security Engineer II

Amazon.com

<div><h2 class="jobSectionHeader"><b>DESCRIPTION</b></h2><div>
Application deadline: Mar 25, 2026<br>
<br>
Amazon&rsquo;s Information Security Penetration Testing Team is seeking a Security Engineer to help keep Amazon secure for its customers. In this role, you will attack Amazon&rsquo;s services, applications, and websites to discover security issues and report them to our internal technology teams. This position will provide you with challenging opportunities, both technologically and as a leader, but will also be a great deal of fun if hacking Amazon alongside a team of highly skilled individuals sounds exciting to you.
<br>
<br>
A Security Engineer at Amazon is expected to be strong in multiple domains. Engineers in this role work closely with teams throughout Information Security, as well as provide technical leadership and advice to teams and leaders throughout Amazon.
<br>
<br>
You will be in direct contact with teams in a variety of business verticals, giving you first hand knowledge about how Amazon is built and how it operates at a deep, technical level. Additionally, you will leverage the knowledge you gain about Amazon to find new ways to break services, processes, and technologies throughout the company. Engineers in this role must show exemplary judgment in making technical trade-offs between short-term fixes and long-term security and business goals.
<br>
<br>
You will demonstrate resilience and navigate ambiguous situations with composure and tact. You will be expected to provide thought leadership for the organization as you discover, invent, and innovate throughout the course of your duties. Above all else, a strong sense of customer obsession is necessary to focus on the ultimate goal of keeping Amazon and its customers secure.<br>
<br>
Key job responsibilities<br>
<ul><li>Conducting high quality application penetration tests independently, or as part of a team</li><li>Creating detailed engagement plans and thoroughly documenting findings, gaps, and remediation recommendations
</li><li>Contributing to team tooling, innovation, and improvements
</li><li>Communicating and collaborating with partner teams, service owners, Information Security, and senior leadership to influence, prioritize, and drive the resolution of discovered security findings</li></ul><br>
About the team<br>
About Amazon Security<br>
<br>
Diverse Experiences<br>
Amazon Security values diverse experiences. Even if you do not meet all of the preferred qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn&rsquo;t followed a traditional path, or includes alternative experiences, don&rsquo;t let it stop you from applying.<br>
<br>
Why Amazon Security<br>
At Amazon, security is central to maintaining customer trust and delivering delightful customer experiences. Our organization is responsible for creating and maintaining a high bar for security across all of Amazon&rsquo;s products and services. We offer talented security professionals the chance to accelerate their careers with opportunities to build experience in a wide variety of areas including cloud, devices, retail, entertainment, healthcare, operations, and physical stores.<br>
<br>
Work/Life Balance<br>
We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why we strive for flexibility as part of our working culture. When we feel supported in the workplace and at home, there&rsquo;s nothing we can&rsquo;t achieve.<br>
<br>
Inclusive Team Culture<br>
In Amazon Security, it&rsquo;s in our nature to learn and be curious. Ongoing DEI events and learning experiences inspire us to continue learning and to embrace our uniqueness. Addressing the toughest security challenges requires that we seek out and celebrate a diversity of ideas, perspectives, and voices.<br>
<br>
Training and Career growth<br>
We&rsquo;re continuously raising our performance bar as we strive to become Earth&rsquo;s Best Employer. That&rsquo;s why you&rsquo;ll find endless knowledge-sharing, training, and other career-advancing resources here to help you develop into a better-rounded professional.</div><h2 class="jobSectionHeader"><b><br>
BASIC QUALIFICATIONS</b></h2><ul><li>Knowledge of networking protocols such as HTTP, DNS and TCP/IP</li><li>Knowledge of industry-based security vulnerabilities and remediation techniques</li><li>3+ years of any combination of the following: threat modeling experience, secure coding, identity management and authentication, software development, cryptography, system administration and network security experience</li><li>2+ years of programming in Python, Ruby, Go, Swift, Java, .Net, C++ or similar object oriented language experience</li><li>3+ years of experience in a penetration testing or information security role</li></ul><h2 class="jobSectionHeader"><b>
PREFERRED QUALIFICATIONS</b></h2><ul><li>Knowledge of cloud service providers and their offerings, preferably AWS, and its various technologies and services</li><li>Experience in developing security tooling and automation</li><li>Experience in CTF competitions, CVE research, and/or Bug Bounty recognition * Advanced degree in Computer Science or related field</li></ul><br>
Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status.<br>
<br>
Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you&rsquo;re applying in isn&rsquo;t listed, please contact your Recruiting Partner.<p><br>
The base salary range for this position is listed below. Your Amazon package will include sign-on payments and restricted stock units (RSUs). Final compensation will be determined based on factors including experience, qualifications, and location. Amazon also offers comprehensive benefits including health insurance (medical, dental, vision, prescription, Basic Life &amp; AD&amp;D insurance and option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage), 401(k) matching, paid time off, and parental leave. Learn more about our benefits at https://amazon.jobs/en/benefits.</p><br>
USA, CO, Virtual Location - Colorado - 159,300.00 - 202,400.00 USD annually<br>
USA, NY, Virtual Location - New York - 159,300.00 - 202,400.00 USD annually<br>
USA, TX, Virtual Location - Texas - 159,300.00 - 202,400.00 USD annually<br>
USA, VA, Virtual Location - Virginia - 159,300.00 - 202,400.00 USD annually</div><p></p>

Security Engineer II, Stores Penetration Testing

Akto

<p> </p><h2><strong>About Akto</strong></h2><p>Akto is an enterprise-grade <strong>Agentic AI Security platform</strong> used by global organizations to discover APIs, continuously test them, and secure AI agents, MCPs, and GenAI applications. Our customers use Akto not for point-in-time reports, but for <strong>ongoing security outcomes across APIs and AI systems</strong>.</p><p>This role is critical to ensuring customers successfully adopt Akto for <strong>real-world API security testing and AI red teaming</strong>.</p><p> </p><h2><strong>Role Overview</strong></h2><p>We are looking for a <strong>hands-on security engineer</strong> with a strong pentesting background who wants to move beyond traditional, report-driven penetration testing.</p><p>As a <strong>Security Engineer – Customer Success</strong>, you will own the security testing journey for Akto customers. You will work directly with customer AppSec, DevSecOps, and Platform teams to run API security testing and AI red teaming using Akto, validate findings, explain impact, and help customers improve their security posture over time.</p><p>This is a <strong>technical, customer-facing role</strong> with real ownership of outcomes.</p><p> </p><h2><strong>Key Responsibilities</strong></h2><p> </p><h3><strong>Customer Security Ownership</strong></h3><ul><li>Own assigned customer accounts from a <strong>security testing and adoption</strong> perspective</li><li>Act as the primary security expert for customers using Akto for API security and AI red teaming</li><li>Ensure customers are actively discovering APIs, running tests, and addressing real vulnerabilities</li></ul><p> </p><h3><strong>API Security Testing</strong></h3><ul><li>Perform hands-on API security testing using Akto:<ul><li>API discovery (including shadow and undocumented APIs)</li><li>Automated and guided API testing</li><li>Validation of findings such as IDORs, auth issues, business logic flaws, SSRF, and data exposure</li></ul></li><li>Go beyond tool output to:<ul><li>Verify findings</li><li>Explain impact</li><li>Recommend practical remediation steps</li></ul></li></ul><p> </p><h3><strong>AI Red Teaming &amp; Agent Security</strong></h3><ul><li>Run AI red teaming exercises using Akto for:<ul><li>AI agents</li><li>MCPs</li><li>GenAI applications and LLM-powered workflows</li></ul></li><li>Understand and test for AI-specific threats such as:<ul><li>Prompt injection</li><li>Data leakage and exfiltration</li><li>Tool misuse and privilege escalation via agents</li></ul></li><li>Translate AI security risks into actionable insights for customers</li></ul><p> </p><h3><strong>Customer Collaboration &amp; Enablement</strong></h3><ul><li>Work closely with customer security and engineering teams to:<ul><li>Explain findings clearly</li><li>Prioritize risks</li><li>Improve secure development practices</li></ul></li><li>Join customer calls to walk through results, answer technical questions, and guide next steps</li></ul><p> </p><h3><strong>Adoption &amp; Product Feedback</strong></h3><ul><li>Proactively identify gaps in product usage or adoption</li><li>Recommend better configurations, additional tests, or expanded use cases</li><li>Provide structured feedback to Product and Engineering teams based on real customer usage</li></ul><p> </p><h2><strong>Required Qualifications</strong></h2><ul><li>3+ years of hands-on experience in <strong>penetration testing, application security, or API security</strong></li><li>Strong understanding of:<ul><li>API security concepts (REST, auth mechanisms, tokens, roles, rate limits)</li><li>Common web and API vulnerabilities</li><li>Business logic and authorization flaws</li></ul></li><li>Experience testing APIs using tools such as Postman, Burp, or similar</li><li>Ability to validate vulnerabilities and explain risk clearly</li><li>Comfortable working directly with customers in a technical role</li></ul><p> </p><h2><strong>Preferred Qualifications</strong></h2><ul><li>Experience with <strong>API-first security tools</strong> or platforms</li><li>Exposure to <strong>AI / LLM security</strong>, red teaming, or agent-based systems</li><li>Familiarity with OpenAPI / Swagger specifications</li><li>Experience working in a customer-facing or consulting role</li><li>Strong written and verbal communication skills</li></ul><p> </p><h2><strong>What Makes This Role Different</strong></h2><ul><li>You will <strong>own security outcomes</strong>, not just generate reports</li><li>You will work on <strong>continuous API security and AI red teaming</strong>, not point-in-time tests</li><li>You will influence:<ul><li>Customer adoption</li><li>Product direction</li><li>Long-term customer success</li></ul></li><li>You will be at the forefront of <strong>API and Agentic AI Security</strong>, an emerging and high-impact space</li></ul><p> </p><h2><strong>Who Will Succeed in This Role</strong></h2><ul><li>A pentester who wants to see vulnerabilities actually fixed</li><li>A security engineer who enjoys working with real production systems</li><li>Someone curious about AI security and excited to learn fast</li><li>A practitioner who values clarity, impact, and ownership</li></ul><p> </p><p> </p>

Customer Security Engineer (API & AI Security)

Search 10000+ Application security engineer jobs near you this March. New roles added regularly across leading industries. Apply today.

10000 application security engineer jobs Near Me

Application Security Engineer

Application Security Engineer

Application Security Engineer

APPLICATION SECURITY ENGINEER

Senior Application Security Engineer II

Security Engineer II, Stores Penetration Testing

Customer Security Engineer (API & AI Security)