application security engineer

PackageX

<div><div><div><div>About PackageX:</div>
<div>
PackageX is the execution layer for physical AI in enterprise logistics. We enable enterprises to see, understand, and execute real-world logistics operations in real time using Vision&ndash;Language&ndash;Action intelligence.</div> 
<div></div>
<div>
We sit between systems of record (ERP, WMS, TMS) and the physical world, turning cameras, people, and automation into deterministic, auditable workflows. Rather than replacing existing systems, PackageX makes them operationally intelligent.</div> 
<div></div>
<div>
We start with inbound receiving, the highest-friction choke point in logistics, and expand across adjacent workflows, sites, and automation modes. This creates a workflow-led enterprise expansion motion that compounds inside complex operations.</div> 
<div></div>
<div>
We're a fast-growing pre-Series A stage startup in New York City with a distributed global team backed by Bullpen Capital, Pritzker Group, Sierra Ventures, Ludlow Ventures, MXV Capital, and NSV Wolf Capital.</div> 
<div></div>
<div>
What we are looking for</div>
<div>
We&rsquo;re looking for a security engineer who is serious about their craft and genuinely curious about where the field is heading. This role sits at the intersection of traditional application security and the new challenges that come with building AI-powered products. You&rsquo;ll own security end-to-end, from hardening our cloud infrastructure and reviewing code, to thinking through what it means to secure systems that use large language models. You don&rsquo;t need to have done this exact job before, but you should be the kind of engineer who stays curious, learns fast, and cares deeply about getting things right.</div> 
<div></div>
<div>
You will:
</div><ul><li>Own security across the SDLC from threat modeling during design, to security reviews during development, to vulnerability scanning in CI/CD. You&rsquo;ll use modern tooling (including AI-powered scanners where they genuinely help) to keep pace with a fast-moving engineering team.</li>
<li>Conduct vulnerability assessments and penetration tests across our web applications, APIs, and infrastructure. You&rsquo;ll identify issues before attackers do, document findings clearly, and work directly with developers to get them fixed.</li>
<li>Write and maintain security policies that engineers will actually follow, clear, practical, and grounded in how the team actually works, not copied from a compliance template.</li>
<li>Think carefully about the security risks that come with AI-powered products, such as prompt injection, sensitive data leaking through model outputs, and how to keep our LLM integrations safe for customers. This is a newer area, and you&rsquo;ll be helping us figure it out as we go.</li>
<li>Report on security posture to engineering leadership, tracking gaps, trends, and open issues in a way that helps the team prioritize and act, not just tick compliance boxes.</li>
<li>Review code for security issues and work closely with developers to fix them, building habits and processes so security feedback becomes a normal part of how the team ships, not a last-minute blocker.</li>
<li>Define and maintain security standards for how we build and deploy software, writing clear guidelines, putting automated checks in place, and making it easy for engineers to do the right thing by default.</li>
<li>Build automation that makes security work scale &mdash; whether that&rsquo;s smarter alerting, faster triage, or tooling that helps developers catch and fix issues without needing a security engineer in every conversation.</li>
<li>Participate in product and engineering design discussions &mdash; raising security concerns early, helping the team understand the risks, and finding solutions that don&rsquo;t slow down shipping.</li>
<li>Embed security into our CI/CD pipelines and development workflows &mdash; reducing the time between finding a vulnerability and getting it fixed, and making security a shared responsibility across the engineering team.</li>
<li>Keep up with how the security landscape is evolving &mdash; particularly as AI becomes a bigger part of how software is built and attacked. You&rsquo;ll bring that knowledge back to the team and help us stay ahead of new threats.</li></ul> 
<div></div>
<div>
Skills and Qualification:</div>
<ul>
<li>A degree in Computer Science, Information Security, or a related field</li>
<li>3+ years of hands-on experience in application security or security engineering.
</li><li>Proven ability to build, manage, and monitor security in production environments where reliability matters &mdash; you&rsquo;ve operated under pressure, handled incidents, and know what it takes to keep systems safe at scale.</li>
<li>Solid experience securing web applications, APIs, and cloud infrastructure &mdash; covering areas like intrusion detection, access control design, incident response, and security policy development. You know the fundamentals well and can apply them in a real product context.</li>
<li>Experience with static and dynamic code analysis, you&rsquo;ve worked with SAST and DAST tools, know their limitations, and can help developers actually act on what those tools surface rather than just generating noise.</li>
<li>Familiarity with modern cloud architectures, serverless, microservices, and API-first designs. Bonus if you&rsquo;ve thought about what it means to secure systems that call LLM APIs or handle AI-generated outputs as part of their core workflow.</li>
<li>Strong understanding of OWASP Top 10 vulnerabilities and how to defend against them. Familiarity with the OWASP Top 10 for LLMs is a plus; we&rsquo;re building AI-powered products and need someone who can think through what that means for security.</li>
<li>Good understanding of RESTful API security, authentication, authorization, rate limiting, and input validation. Our platform is API-heavy, and we need someone who can spot the common mistakes and knows how to prevent them.</li>
<li>Strong experience in penetration testing and vulnerability analysis. You can run an assessment end-to-end, write up findings that people actually read, and follow through until issues are resolved &mdash; not just hand over a report and move on.</li>
<li>Experience working with AWS and/or GCP, securing cloud infrastructure, managing IAM policies, and understanding how cloud-native services introduce their own security considerations. We run primarily on AWS.</li></ul> 
<div></div>
<div>
What can you expect from the application process?</div>
<div>
All applications will be looked at by the People team, who will reach out to shortlisted candidates. Across various interview rounds, you'll speak with the hiring manager and other functional heads. We want to have an open discussion about your work and how we can be a great fit. The process may also involve an assessment or presentation relevant to the role. You can expect an offer after three rounds of interviews. All offers are subject to satisfactory reference and background checks.</div> 

</div></div>
<div><div>We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.</div></div></div>

Application Security Engineer

ServiceTitan

<div><h2 class="jobSectionHeader">Ready to be a Titan?</h2>
At ServiceTitan, we are transforming product security into a core part of how engineering delivers software. We are looking for an exceptional Senior Application Security Engineer to help us build a &quot;Secure Paved Road&quot;&mdash;an automated, self-service ecosystem that enables our 80+ R&amp;D squads to build securely by default.
This role will define and scale how secure software is built at ServiceTitan by embedding security directly into the development lifecycle, from code to production. It will reduce organizational risk by automating detection and remediation of vulnerabilities, standardizing secure architecture patterns, and eliminating entire classes of security issues at their source. By partnering closely with engineering, this role will drive a shift toward secure by default development while continuously validating defenses through testing, threat modeling, and proactive simulation.<h2 class="jobSectionHeader">
What you&rsquo;ll do:</h2><h2 class="jobSectionHeader">
1. Build the Secure Paved Road (Pipeline and Code)</h2><ul><li>
Pipeline Automation: Deeply integrate GitHub Advanced Security into the CI/CD pipeline to act as automated checkpoints, providing fast feedback to engineers without manual intervention.</li><li>
Secure by Default Code: Collaborate with Engineering to develop and maintain secure microservice templates and libraries with embedded security controls.</li><li>
Secrets and Supply Chain: Lead hardcoded secrets mitigation efforts by automating detection and building workflows to validate compromised credentials via API.</li><li>
Secure SDLC Practices: Drive cross functional initiatives to establish and continuously improve secure software development lifecycle practices across the organization.</li></ul>
2. Continuous Security Testing and Validation<ul><li>
Penetration Testing: Lead onboarding and operation of continuous penetration testing capabilities across web applications and services.</li><li>
Security Assessments: Participate in and help scale internal security assessments, penetration testing, and bug bounty programs.</li><li>
Tooling Ownership: Evaluate, prototype, implement, and operate security tools including DAST, SAST, and SCA.</li><li>
Simulation and Validation: Run proactive simulations based on emerging threats to validate defenses and identify gaps.</li></ul><h2 class="jobSectionHeader">
3. Architecture and Threat Modeling</h2><ul><li>
Security Design Reviews: Lead security design reviews and threat modeling for new and existing services.</li><li>
Secure Architecture: Develop and maintain secure architecture standards, frameworks, and reusable patterns across multiple layers of the stack.</li><li>
Emerging Threat Analysis: Continuously analyze evolving security threats, determine relevance, and implement centralized mitigations.</li></ul><h2 class="jobSectionHeader">
4. Operational Support and Engineering Partnership</h2><ul><li>
Technical Leadership: Act as the AppSec technical expert for the Security Champions Program, guiding engineers on vulnerability remediation and secure coding practices.</li><li>
Contextual Training: Implement just in time training mechanisms that help engineers remediate vulnerabilities as they are introduced.</li><li>
Triage to Automate: Own initial triage of vulnerability findings, identify patterns, and drive automation and guardrails to reduce recurring issues.</li><li>
Incident Response: Participate in security incident response and support post incident analysis and remediation efforts.</li></ul><h3 class="jobSectionHeader">
5. Continuous Improvement and Expertise</h3><ul><li>
Maintain strong knowledge of current security threats, vulnerabilities, and operational best practices, applying that knowledge to continuously improve the organization&rsquo;s security posture.</li></ul><h2 class="jobSectionHeader">
What you&rsquo;ll bring:</h2><ul><li>
Experience: 5+ years of experience in Product/Application Security, with a strong background in software engineering.</li><li>
Coding Expertise: Proficiency in C#/.NET (preferred) or Go/Java. You must be able to read code to find vulnerabilities and write code to fix them.</li><li>
Modern AppSec: Experience moving security &quot;left&quot; using tools like GitHub Advanced Security (GHAS), dependency scanners, and secret detectors.</li><li>
Automation Mindset: Proven ability to script (Python, Go, PowerShell) and automate security tasks. You prefer building a tool to solve a problem over fixing it manually.</li><li>
AI Forward: Interest in the intersection of AI and Security, specifically in securing AI workloads, leveraging AI capabilities to embed security throughout the SDLC, and using AI agents for defense.</li></ul><h2 class="jobSectionHeader">
Why this role?</h2>
Own Outcomes, Not Activity: Your success will be measured by real risk reduction. You will directly influence vulnerability backlog reduction, remediation velocity, and the overall security posture of the organization.
Operate at the Intersection of Engineering and Security: You will work side by side with engineering teams to shape how software is built, secured, and deployed. This role gives you the platform to influence architecture, development practices, and platform level controls. 
Lead the Next Evolution of AppSec: You will help define how modern security teams leverage automation and intelligent systems to scale. From secure by design patterns to autonomous testing and remediation, you will be pushing the boundaries of how security is done. 
High Ownership, High Leverage: You will have the autonomy to identify problems, design solutions, and implement them end to end. The work you do will scale across teams and services, amplifying your impact well beyond a single application or domain.
Be Human With Us:
Being human isn&rsquo;t about checking every box on a list. It&rsquo;s about the experiences we have, people we meet, and the perspectives we share. So, if you have the skills but are hesitant to apply because of your background, apply anyway. We need amazing people like you to help us challenge the conventional and think differently about the problems that we&rsquo;re solving. We&rsquo;re in this together. Come be human, with us. 
 
Use of AI Technology:
We use technology, including automated and AI-assisted tools, to support certain aspects of our recruitment process. These tools are designed to improve efficiency and enhance the candidate experience. AI tools are not used to make hiring decisions; all hiring decisions are made by our hiring teams.
What We Offer: 
When you join our team, you&rsquo;re not just accepting a job. You&rsquo;re making a career move. Here&rsquo;s how we&rsquo;ll support you in doing some of the most impactful work of your career:<ul><li>
Flextime, recognition, and support for autonomous work: Flexible time off with ample learning and development opportunities to continue growing your career. We offer a comprehensive onboarding program, leadership training for Titans at all levels, and other programs and events. Great work is rewarded through Bonusly, peer-nominated awards, and more.</li><li>
Holistic health and wellness benefits: Company-paid medical, dental, and vision (with 100% employer paid options and 90% coverage for dependents), FSA and HSA, 401k match, and telehealth options including memberships to One Medical.</li><li>
Support for Titans at all stages of life: Parental leave and support, up to $20k in fertility services (i.e. IUI and IVF), surrogacy, and adoption reimbursement, on demand maternity support through Maven Maternity, free breast milk shipping through Maven Milk, pet insurance, legal advisory services, financial planning tools, and more.</li></ul>
At ServiceTitan, we celebrate individuality and uniqueness. We believe that the convergence of fresh perspectives and experiences from all walks of life is what makes our product and culture so great. We strongly encourage people from underrepresented groups to apply. We do not discriminate against employees based on race, color, religion, sex, national origin, gender identity or expression, age, disability, pregnancy (including childbirth, breastfeeding, or related medical condition), genetic information, protected military or veteran status, sexual orientation, or any other characteristic protected by applicable federal, state or local laws.
ServiceTitan is committed to fair and equitable compensation for all of our employees. We thoughtfully consider a wide range of factors when determining individual compensation.The expected salary range for this role for candidates residing in the United States is between $125,700 USD - $168,100 USD. Compensation for candidates residing outside the United States will vary by location and the specific salary range will be discussed during the hiring process. Actual compensation for an individual may vary depending on skills, performance over time, qualifications, experience, and location. In addition to the base salary, the total compensation package also includes an annual bonus, equity and a holistic suite of benefits.</div>

Senior Application Security Engineer

<div>Ready to be a Titan?
At ServiceTitan, we are transforming product security into a core part of how engineering delivers software. We are looking for an AI-Focused Senior Application Security Engineer to help define and deliver a secure paved road, creating automated, developer friendly security patterns that enable our 80 plus R&amp;D teams to build securely by default without slowing down innovation.
In this role, you will partner closely with engineering to embed practical guardrails, manage emerging risks like non-human identities and data exposure, and enable teams to move quickly without compromising trust. This is an opportunity to shape the future of application security in an AI first environment, turning security into a core enabler of innovation rather than a constraint.<h2 class="jobSectionHeader">
What you&rsquo;ll do:</h2>
1. Secure-by-Design Engineering<ul><li>
Pipeline Automation: Embed security directly into the development pipeline through intelligent prompting and AI driven agents.</li><li>
Secure-by-Default Code: Collaborate with Engineering to develop and maintain secure microservice templates and libraries that have security controls built in from the start.</li><li>
Supply Chain Protections: Implement controls to secure dependencies, build artifacts, and third party integrations. Partner with engineering to enforce integrity, provenance, and policy checks within build and release workflows.</li></ul>
2. AI-Driven Security Testing &amp; Validation<ul><li>
Automated Scanning: Evaluate, configure, and implement AI agentic tooling to autonomously test our web applications for vulnerabilities.</li><li>
Simulation &amp; Validation: Use agentic tooling to run proactive simulations based on emerging threats to validate our defenses in real time.</li><li>
Outcome Accountability: Drive adherence to vulnerability remediation SLAs by partnering with engineering teams to track, prioritize, and resolve security issues. Ensure clear ownership, measurable progress, and consistent follow through to reduce risk and maintain accountability.</li></ul>
3. AI &amp; Identity Security<ul><li>
AI Guardrails: Design and implement technical guardrails for AI Coding Agents and Model Context Protocols (MCP) to ensure safe adoption of AI in the development lifecycle.</li><li>
AI-Driven Tooling: Help operationalize AI based tooling to act as a &quot;GPS&quot; for developers, tuning the system to provide accurate, on demand threat modeling, design, and development advice.</li><li>
Non-Human Identity Management: Partner with engineering to define and implement strategies for managing machine identities across AI systems, including service accounts, API keys, and agent authentication. Enforce least privilege access, credential lifecycle management, and integration with secrets management and CI CD pipelines to reduce risk and prevent misuse.</li></ul>
4. Developer Enablement &amp; Security Operations<ul><li>
Technical &quot;Pit Crew&quot;: Act as the AppSec technical expert for the Security Champions Program. While leadership manages the program logistics, you will be the expert answering complex coding questions and guiding Champions on how to fix vulnerabilities.</li><li>
Contextual Training: Assist in setting up &quot;Just in Time&quot; training campaigns that trigger micro-trainings when engineers introduce vulnerabilities, allowing them to fix their own code.</li><li>
Triage to Automate: Own the initial triage of incoming vulnerability tickets (SAST/SCA). You will use this hands on work to identify the &quot;noise&quot; and pattern match recurring issues, directly informing which guardrails you build next.</li></ul><h2 class="jobSectionHeader">
What you&rsquo;ll bring:</h2><ul><li>
Experience: 5+ years of experience in Product/Application Security, with a strong background in software engineering.</li><li>
Demonstrated AI Expertise: Proven experience at the intersection of AI and security, including securing AI workloads and leveraging AI agents to enhance defensive capabilities.</li><li>
Modern AppSec: Experience implementing tools and driving for secure outcomes throughout the Secure Software Development Lifecycle including Threat Modeling, Code Scanning, and Penetration testing.</li><li>
Automation Mindset: Proven ability to prompt, script, and automate security tasks. You prefer building a tool to solve a problem over fixing it manually.</li></ul><h2 class="jobSectionHeader">
Why this role?</h2>
Own Outcomes, Not Activity: Your success will be measured by real risk reduction. You will directly influence vulnerability backlog reduction, remediation velocity, and the overall security posture of the organization. 
Operate at the Intersection of Engineering and Security: You will work side by side with engineering teams to shape how software is built, secured, and deployed. This role gives you the platform to influence architecture, development practices, and platform level controls.
Lead the Next Evolution of AppSec: You will help define how modern security teams leverage automation and intelligent systems to scale. From secure by design patterns to autonomous testing and remediation, you will be pushing the boundaries of how security is done. 
High Ownership, High Leverage: You will have the autonomy to identify problems, design solutions, and implement them end to end. The work you do will scale across teams and services, amplifying your impact well beyond a single application or domain.
Be Human With Us:
Being human isn&rsquo;t about checking every box on a list. It&rsquo;s about the experiences we have, people we meet, and the perspectives we share. So, if you have the skills but are hesitant to apply because of your background, apply anyway. We need amazing people like you to help us challenge the conventional and think differently about the problems that we&rsquo;re solving. We&rsquo;re in this together. Come be human, with us. 
 
Use of AI Technology:
We use technology, including automated and AI-assisted tools, to support certain aspects of our recruitment process. These tools are designed to improve efficiency and enhance the candidate experience. AI tools are not used to make hiring decisions; all hiring decisions are made by our hiring teams.
What We Offer: 
When you join our team, you&rsquo;re not just accepting a job. You&rsquo;re making a career move. Here&rsquo;s how we&rsquo;ll support you in doing some of the most impactful work of your career:<ul><li>
Flextime, recognition, and support for autonomous work: Flexible time off with ample learning and development opportunities to continue growing your career. We offer a comprehensive onboarding program, leadership training for Titans at all levels, and other programs and events. Great work is rewarded through Bonusly, peer-nominated awards, and more.</li><li>
Holistic health and wellness benefits: Company-paid medical, dental, and vision (with 100% employer paid options and 90% coverage for dependents), FSA and HSA, 401k match, and telehealth options including memberships to One Medical.</li><li>
Support for Titans at all stages of life: Parental leave and support, up to $20k in fertility services (i.e. IUI and IVF), surrogacy, and adoption reimbursement, on demand maternity support through Maven Maternity, free breast milk shipping through Maven Milk, pet insurance, legal advisory services, financial planning tools, and more.</li></ul>
At ServiceTitan, we celebrate individuality and uniqueness. We believe that the convergence of fresh perspectives and experiences from all walks of life is what makes our product and culture so great. We strongly encourage people from underrepresented groups to apply. We do not discriminate against employees based on race, color, religion, sex, national origin, gender identity or expression, age, disability, pregnancy (including childbirth, breastfeeding, or related medical condition), genetic information, protected military or veteran status, sexual orientation, or any other characteristic protected by applicable federal, state or local laws.
ServiceTitan is committed to fair and equitable compensation for all of our employees. We thoughtfully consider a wide range of factors when determining individual compensation.The expected salary range for this role for candidates residing in the United States is between $125,700 USD - $168,100 USD. Compensation for candidates residing outside the United States will vary by location and the specific salary range will be discussed during the hiring process. Actual compensation for an individual may vary depending on skills, performance over time, qualifications, experience, and location. In addition to the base salary, the total compensation package also includes an annual bonus, equity and a holistic suite of benefits.</div>

Senior Application Security Engineer, AI

Parker Hannifin

<div>Position Summary
POSITION SUMMARY:
The Web Application Security Engineer is responsible for enterprise Web Application Firewall and edge security operations protecting high-traffic ecommerce applications and APIs. This role provides hands-on ownership of Akamai security platforms and supports additional security technologies.
This position requires strong operational discipline, deep understanding of web application threats, and the ability to balance security enforcement with availability and customer experience in production environments.
Responsibilities
Essential Functions:<ul><li>
Monitor and analyze inbound web traffic to identify and respond to suspicious activities, ensuring real-time threat mitigation.
</li><li>Collaborate with cross functional teams to integrate WAF solutions into CI/CD pipelines and application architectures and focus on maturing WAF protections.
</li><li>Maintain and optimize WAF configurations to balance security, performance, and user experience and enable process optimization and automation.
</li><li>Be involved in regular security assessments, vulnerability scans, and penetration testing to identify gaps in WAF protection.
</li><li>Maintain a close working relation with the Application Development team to ensure optimal protections are used for all new application releases.
</li><li>Ensure adequate testing and validation and has been performed for all protections and mitigations before rollout.
</li><li>Collaborate with our Software Development, Quality Assurance, and Project Management teams to solve difficult technical problems, define and deliver highly scalable cloud applications and make fact-based recommendations regarding tactical and strategic technology adoption for our team.</li><li>
Promote, foster, and proactively implement agile best practices daily.</li><li>
Design, deploy, and manage WAF solutions for on-premise and cloud-based platforms</li><li>
Develop and fine-tune WAF policies, rules, and signatures to mitigate known threats and application abuses as well as emerging threats.
</li><li>Lead incident response efforts for web application and network attacks, including root cause analysis and remediation.</li><li>
Participate in on-call rotations to support 24/7 operations as needed.
</li></ul>Qualifications
Qualifications &amp; Required Skills:<ul><li>
4 year University/College Degree or equivalent.</li><li>
5+ years in the IT field and 3+ years of hands-on experience managing cloud-based WAF platforms, Akamai preferred</li><li>
You are comfortable working in a full stack software development environment.</li><li>
Experience analyzing security logs, traffic patterns, and attack behavior</li><li>
Strong networking fundamentals and familiarity with network protocols (HTTP/HTTPS, TCP/IP, DNS) and web technologies (HTML, JavaScript, APIs).
</li><li>Solid understanding of all phases of the web Software Development Life Cycle</li><li>
Deep understanding of digital platforms and technologies</li><li>
Experience in System Integration touch points &ndash; API Gateway, ETL, WebServices (REST,SOAP)</li><li>
Experience in working within an Agile/SCRUM software development model</li><li>
Strong troubleshooting, analytical, and problem-solving skills</li><li>
Ability to adapt to changing roles and changing priorities</li><li>
Strong interpersonal skills and relate well with all levels of the organization</li><li>
Excellent written and verbal communication skills</li></ul> 
Parker Hannifin
Parker Hannifin is a Fortune 250 global leader in motion and control technologies. For more than a century, we&rsquo;ve enabled engineering breakthroughs that make energy cleaner, transportation safer, medical treatments more effective, and manufacturing more efficient.
With empowered team members in more than 40 countries, Parker serves customers across aerospace &amp; defense, energy, HVAC &amp; refrigeration, in-plant &amp; industrial equipment, off-highway and transportation.
Our scale is global, but our purpose is personal. We enable breakthroughs that improve lives, strengthen communities and create a brighter future.
Our Purpose &mdash; Enabling Engineering Breakthroughs that Lead to a Better Tomorrow &mdash; comes to life through our people-first culture where teamwork drives performance, inclusion fuels innovation and growth is encouraged. This environment fosters collaboration and empowers team members from engineering and manufacturing to finance, supply chain, human resources, information technology and beyond.
By combining deep expertise with an entrepreneurial spirit, we help customers succeed in markets that demand performance, reliability, and sustainability.
As we look to the future, Parker is advancing initiatives in energy efficiency and sustainability while developing the next generation of talent and leaders to engineer a better tomorrow.
Equal Employment Opportunity
Parker is an Equal Opportunity and Affirmative Action Employer. Parker is committed to ensuring equal employment opportunities for all job applicants and employees. Employment decisions are based upon job related reasons regardless of race, ethnicity, color, religion, sex, sexual orientation, age, national origin, disability, gender identity, genetic information, veteran status, or any other status protected by law. However, U.S. Citizenship, Permanent Residency or other appropriate status is required for certain positions, in accord with U.S. import &amp; export regulations. 
 
(&ldquo;Minority / Female / Disability / Veteran / VEVRAA Federal Contractor&rdquo;)
If you would like more information about Equal Employment Opportunity as an applicant under the law, please go to Employees &amp; Job Applicants | U.S. Equal Employment Opportunity Commission</div>

Digital & IT Technical Spec 1 - Web Application Security

Octdaily

<div>
 
 Role Overview
 
 
 We are seeking a Mid&ndash;Senior Offensive Security Engineer with hands-on expertise in vulnerability assessment, penetration testing, red teaming, and Azure environment security assessments. The candidate should possess strong technical experience in web, API, and mobile application security, and be able to assess configurations based on CIS controls, NIST, and other industry standards.
 
 
 
 
 
 Key Responsibilities
 
 
 &bull; Perform comprehensive VAPT across web, API, and mobile applications.
 
 
 &bull; Conduct red team operations and adversarial simulations to assess defense posture.
 
 
 &bull; Perform Azure WAF and cloud environment configuration reviews and recommend hardening measures.
 
 
 &bull; Evaluate environments against CIS Controls, NIST, and internal baselines.
 
 
 &bull; Collaborate with DevSecOps and cloud engineering teams to support secure design and remediation.
 
 
 &bull; Assist with automation of security testing and vulnerability management workflows.
 
 
 
 
 
 Required Experience &amp; Skills
 
 
 &bull; 5&ndash;8 years of hands-on experience in offensive security or penetration testing roles.
 
 
 &bull; Expertise in web, API, and mobile application testing (Burp Suite, OWASP ZAP, Postman, MobSF, Frida).
 
 
 &bull; Strong understanding of OWASP Top 10, CWE, MITRE ATT&amp;CK, and exploitation methodologies.
 
 
 &bull; Experience in Azure security (WAF, Key Vault, App Services, Azure AD).
 
 
 &bull; Proficiency in scripting languages such as Python, PowerShell, or Bash.
 
 
 &bull; Knowledge of CIS Benchmarks and common cloud misconfigurations.
 
 
 
 
 
 Preferred Skills / Certifications
 
 
 &bull; Certifications: OSCP, OSWE, CRTP, OSEP, AZ-500, or CREST CRT.
 
 
 &bull; Familiarity with SIEM/EDR evasion and threat simulation techniques.
 
</div>

Offensive Security Engineer

Apple

Imagine what you could do here. At Apple, great ideas have a way of becoming great products, services, and customer experiences very quickly - making the kind of impact that changes people's lives. 
 
The Apple Health Software team embodies the core Apple values around delighting our customers with groundbreaking user experiences, empowering users to live a better - and healthier - life, while keeping their data safe, private, and secure. 
 
We are seeking a self-driven senior security engineer to join Apple&rsquo;s Health team to contribute to efforts supporting Apple&rsquo;s health research tools and ecosystem. As a member of our team, you will have the unique and rewarding opportunity to enable teams across the company to conduct health research and ensure that research participant data is safe, private, and secure. 
 
Description 
 
As a Senior Security Engineer, you will be responsible for ensuring the security of the systems used to develop Apple&rsquo;s health features. You will conduct manual application security tests and audit source code to support releases. You'll construct security testing plans and conduct testing to ensure security controls are in place and implemented correctly. You may develop tooling to support security improvement initiatives for the platform and provide security guidance for new projects, features, and changes to Health related projects.&quot;,&quot;responsibilities&quot;:&quot;Conduct manual application security tests and audit source code to support releases 
 
Design and execute comprehensive security testing plans to validate security controls are properly implemented 
 
Perform threat modeling exercises for new features and research tools 
 
Review architecture and design documents to identify security risks and recommend mitigations 
 
Develop and maintain security tooling and automation to improve the security posture of our platform 
 
Provide security guidance and consultation for new projects, features, and changes to Health related projects 
 
Preferred Qualifications 
 
Background in web application development and/or code auditing 
 
Experience with security testing and review of medical or health related applications 
 
Experience with multi-cloud platform applications 
 
Minimum Qualifications 
 
Bachelor&rsquo;s degree in Computer Science, Information Security, or a related technical field (or equivalent practical experience) with 10+ years of experience in security engineering 
 
Extensive knowledge of security principles, technologies, and best practices across multiple domains, including cloud security, network security, application security, and data security 
 
Experience with threat modeling, vulnerability management, incident response, and security automation 
 
Comprehensive grasp of security risks and challenges associated with large-scale, complex systems and datasets 
 
Background in building scalable software systems and platforms 
 
Strong communication and collaboration skills, with the ability to succinctly communicate security concerns to mixed audiences 
 
Apple is an equal opportunity employer that is committed to inclusion and diversity. We seek to promote equal opportunity for all applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, Veteran status, or other legally protected characteristics. Learn more about your EEO rights as an applicant . 
 
Pay &amp; Benefits 
 
At Apple, base pay is one part of our total compensation package and is determined within a range. This provides the opportunity to progress as you grow and develop within a role. The base pay range for this role is between $201,300 and $302,200, and your base pay will depend on your skills, qualifications, experience, and location. 
 
Apple employees also have the opportunity to become an Apple shareholder through participation in Apple's discretionary employee stock programs. Apple employees are eligible for discretionary restricted stock unit awards, and can purchase Apple stock at a discount if voluntarily participating in Apple's Employee Stock Purchase Plan. You'll also receive benefits including: Comprehensive medical and dental coverage, retirement benefits, a range of discounted products and free services, and for formal education related to advancing your career at Apple, reimbursement for certain educational expenses - including tuition. Additionally, this role might be eligible for discretionary bonuses or commission payments as well as relocation. Learn more about Apple Benefits. 
 
Note: Apple benefit, compensation and employee stock programs are subject to eligibility requirements and other terms of the applicable plan or program.

Staff Security Engineer - Health Software

Arpatech

Job Title: DevSecOps EngineerLocation: Karachi or Islamabad(on-site), other cities remoteShift Timings: 9 am to 6 pmArpatech (Pvt) Ltd is looking for a DevSecOps/AppSec specialist with 3-4 years of experience to integrate security into our software lifecycle. You will bridge the gap between development, operations, and security to build resilient cloud-native applications.Core Responsibilities1. CI/CD Integration: Embed security controls and automated gates into Jenkins pipelines.2. Security Testing: Design and execute SAST, DAST, and SCA (Software Composition Analysis) to identify vulnerabilities early.3. Code &amp; Architecture Review: Perform deep-dive manual source code reviews and security assessments.4. Infrastructure Security: Secure Docker/Kubernetes environments and cloud platforms (AWS/Azure).5. Remediation &amp; Guidance: Partner with developers to implement secure coding practices (OWASP Top 10) and patch vulnerabilities.6. Automation: Build custom security tooling and frameworks using Python or Bash.Technical Requirements- Experience: 3-4 years in DevSecOps or Application Security.- Tools: Jenkins, Git, Docker, Kubernetes, and Cloud (AWS or Azure).- Knowledge: Expertise in the OWASP Top 10, secure configuration management, and application hardening.- Testing: Proficiency in security testing methodologies and automated scanning tools.- Education: Bachelor&rsquo;s degree in Computer Science or a related field.- Bonus: Certifications like OSCP, OSWE, or AWS Certified Security are highly preferred.Soft Skills- Strong analytical and problem-solving mindset.- Excellent communication skills for cross-functional collaboration.- Proactive approach to staying ahead of emerging security trends.Work Location: Remote

DevSecOps Engineer

Search 10000+ Application security engineer jobs near you this April. New roles added regularly across leading industries. Apply today.