application security lead

Synchrony

<div>Job Description:
Role Summary/Purpose:
Synchrony is seeking an AVP, Product Security Architect to provide enterprise-level product security architecture leadership across Synchrony&rsquo;s application and SaaS ecosystem. This role operates at L11 scope&mdash;setting direction, defining standards, and driving adoption at scale&mdash;while partnering closely with product and engineering leaders to embed security into product strategy and modern software delivery.
The AVP will lead the definition of an Application Security Blueprint (reference architectures, approved patterns, and engineering guardrails) and will influence outcomes across multiple portfolios by enabling teams to design and deliver software that is secure-by-design, resilient, and compliant.
Essential Responsibilities:<ul><li>
Set product security architecture direction for assigned portfolios, aligning security architecture decisions with Synchrony technology strategy, risk appetite, and regulatory expectations.</li><li>
Own and evolve the Application Security Blueprint: enterprise application security standards, reference architectures, reusable patterns, and guardrails that enable consistent secure engineering across teams.</li><li>
Serve as a strategic partner to product and engineering leadership, influencing roadmaps and operating models to ensure security is built-in (not bolted-on) and delivery teams can move quickly with well-defined paved roads.</li><li>
Lead architecture governance for product/application security:<ul><li>
establish review criteria and decision frameworks</li><li>
perform design reviews and approve/drive remediation plans</li><li>
manage exceptions with documented risk acceptance, compensating controls, and time-bound closure</li></ul></li><li>
Drive threat modeling at scale by defining methodology and minimum expectations, and by facilitating modeling for high-risk initiatives&mdash;explicitly documenting trust boundaries, data flows, abuse cases, and security requirements.</li><li>
Define and standardize API security architectures (north-south and east-west), including authentication/authorization, token strategy, schema and input validation, anti-automation protections, and rate limiting/throttling patterns.</li><li>
Define patterns for service-to-service security controls in distributed systems, including workload identity, authorization, mTLS, secrets handling, and policy enforcement&mdash;ensuring controls are practical for engineering adoption.</li><li>
Influence and enable secure SDLC and platform controls with engineering enablement in mind (security requirements, pipeline guardrails, dependency/supply-chain controls, secure configuration guidance), partnering with platform teams to operationalize.</li><li>
Establish and track measurable outcomes (e.g., blueprint adoption, recurring architecture risks, API posture improvements, exception burn-down, control coverage for critical apps) and provide clear executive-level reporting.</li><li>
Act as a coach and multiplier: mentor engineers and architects, elevate secure design skills across teams, and improve security decision-making through clear documentation and reusable assets.</li><li>
Perform other duties and/or special projects as assigned.</li></ul>
Qualifications/Requirements:<ul><li>
7+ years in security architecture/engineering, with deep focus on application/product security in modern software environments.</li><li>
Demonstrated ability to operate at an enterprise influence level: setting standards, driving cross-team adoption, and aligning stakeholders with differing priorities.</li><li>
Strong hands-on knowledge of application and service security fundamentals: authentication/authorization, session/token security, cryptography concepts, secrets management, secure logging/monitoring design, and secure data handling.</li><li>
Proven experience leading threat modeling and producing strong architecture artifacts (DFDs, trust boundaries, security requirements, risk assessments).</li><li>
Strong knowledge of API security and common web/service risks (e.g., OWASP Top 10 / API Security Top 10), with the ability to translate risks into enforceable patterns.</li><li>
Excellent communication skills&mdash;able to present clearly to engineering teams and senior leaders, and to produce high-quality architecture documentation.</li><li>
Track record of driving security with product teams: embedding security into product planning, influencing roadmaps, defining &ldquo;definition of done&rdquo; security requirements, and improving time-to-market through paved-road patterns.</li><li>
Experience securing and integrating SaaS applications, including SSO/federation (SAML/OIDC), tenant and data isolation considerations, audit logging, and shared responsibility alignment.</li><li>
Experience implementing service-to-service security patterns at scale (workload identity, mTLS, authorization, policy-as-code concepts).</li><li>
Experience operationalizing security standards into engineering consumables (shared libraries, templates, reference implementations, runbooks).</li><li>
Familiarity with CI/CD-based security enablement (SAST/DAST/SCA, secrets scanning, gating/exception workflows) and vulnerability management operating models.</li><li>
Experience supporting regulated environments and mapping architecture controls to policies/standards.</li><li>
Certifications (preferred): CISSP, CCSP, CSSLP (or equivalent).</li><li>
Ability and flexibility to travel for business as required</li></ul>
Desired Characteristics:<ul><li>
Threat modeling tooling;
</li><li>API gateways/policy enforcement; identity and federation (SSO, SAML, OIDC);
</li><li>application security testing (SAST/DAST/SCA/secret scanning);
</li><li>CI/CD tooling (e.g., GitHub/Jenkins); vulnerability management platforms; logging/monitoring;
</li><li>service mesh/mTLS patterns; secrets management solutions</li></ul>
Grade/Level: 11
The salary range for this position is 115,000.00 - 200,000.00 USD Annual and is eligible for an annual bonus based on individual and company performance.
Actual compensation offered within the posted salary range will be based upon work experience, skill level or knowledge.
Salaries are adjusted according to market in CA, NY Metro and Seattle.
Eligibility Requirements:<ul><li>
You must be 18 years or older</li><li>
You must have a high school diploma or equivalent</li><li>
You must be willing to take a drug test, submit to a background investigation and submit fingerprints as part of the onboarding process</li><li>
You must be able to satisfy the requirements of Section 19 of the Federal Deposit Insurance Act.</li><li>
New hires (Level 4-7) must have 9 months of continuous service with the company before they are eligible to post on other roles. Once this new hire time in position requirement is met, the associate will have a minimum 6 months&rsquo; time in position before they can post for future non-exempt roles. Employees, level 8 or greater, must have at least 18 months&rsquo; time in position before they can post. All internal employees must consistently meet performance expectations and have approval from your manager to post (or the approval of your manager and HR if you don&rsquo;t meet the time in position or performance expectations).</li></ul>
Legal authorization to work in the U.S. is required. We will not sponsor individuals for employment visas, now or in the future, for this job opening. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or veteran status.
Our Commitment:
When you join us, you&rsquo;ll be part of an inclusive culture where your individual skills, experience, and voice are not only heard &ndash; but valued. Together, we&rsquo;re building a future where we can all belong, connect, and turn ideals into action. More than 50% of our workforce is engaged in our Employee Resource Groups (ERGs), where community and passion intersect to offer a safe space to learn and grow. 
This starts when you choose to apply for a role at Synchrony. We ensure all qualified applicants will receive consideration for employment without regard to age, race, color, religion, gender, sexual orientation, gender identity, national origin, disability, or veteran status. We&rsquo;re proud to have an award-winning culture for all.
Reasonable Accommodation Notice:
<ul><li>Federal law requires employers to provide reasonable accommodation to qualified individuals with disabilities. Please tell us if you require a reasonable accommodation to apply for a job or to perform your job. Examples of reasonable accommodation include making a change to the application process or work procedures, providing documents in an alternate format, using a sign language interpreter, or using specialized equipment.</li><li>
If you need special accommodations, please call our Career Support Line so that we can discuss your specific situation. We can be reached at 1-866-301-5627. Representatives are available from 8am &ndash; 5pm Monday to Friday, Central Standard Time</li></ul>
Job Family Group:
Information Technology</div>

AVP, Product Security Architect

Goldman Sachs

<div>
 
 Job Description
 
 
 
 
 Role Overview
 
 
 
 The Lead Information Security Officer for Asset Management is a critical leadership position responsible for defining, implementing, and overseeing the comprehensive information security and cybersecurity risk posture specifically within the Asset Management Private business. This role is pivotal in balancing commercial objectives with robust security controls, ensuring the division's resilience against an evolving threat landscape, and protecting client assets and data.
 
 
 This leader will directly manage and provide strategic direction to teams responsible for Governance, Risk &amp; Compliance (GRC), Application Security &amp; Advisory, and Product Security functions within Asset Management. Crucially, this role also involves the oversight and guidance of embedded Technology Risk Officers who are assigned to various Asset Management Private business vertical. The objective is to foster a unified and proactive approach to risk management, ensuring regulatory compliance, and enabling secure technological innovation across all Asset Management initiatives.
 
 
 
 Key Responsibilities
 
 
 
 <ul>
 <li>
 Work with internal application development teams that are developing the next generation of critical business applications, enable them to understand Information Security and Business Resiliency control requirements, and advise on the integration of these controls into their applications
 </li>
 <li>
 Collaborate with the global Application Security Risk, Business Continuity, Risk Measurement, and other global Technology Risk teams to develop and integrate best-in-class security and resiliency controls and practices.
 </li>
 <li>
 Communicate the impact of technology risks and the approach to mitigation/acceptance and provide risk assessment and advisory services to technology engineers, and technology and business management.
 </li>
 <li>
 Assess existing applications for design-related security risks and assist teams in determining appropriate remediation steps
 </li>
 <li>
 Provide guidance to engineering leadership and application developers on existing and emerging threats in the web and mobile application space.
 </li>
 <li>
 Drive adoption of embedded application security controls as part of the Software Development Life Cycle (SDLC).
 </li>
 <li>
 Provide deep subject matter expertise to application teams in secure application design and development approaches and techniques.
 </li>
 <li>
 Contribute to the technical understanding, adoption and convergence of information security standards, solutions and tools.
 </li>
 <li>
 Work with engineers to develop customized security testing strategy to complement the existing security testing program managed by Technology Risk.
 
 
 </li>
 </ul>
 
 Skills And Experience Required
 
 
 
 <ul>
 <li>
 Experience: 5+ years of progressive experience in Multi domain Information Security experience such as vendor security, application security, vulnerability management, data loss prevention, data encryption, and infrastructure security.
 </li>
 <li>
 Regulatory &amp; Risk Expertise: Expert knowledge of global financial regulations (e.g., SEC , FINRA , GDPR , CCPA ) and proven experience applying risk management methodologies such as FAIR (Factor Analysis of Information Risk) or similar frameworks.
 </li>
 <li>
 Leadership &amp; Management: Proven ability to build, mentor, and lead high-performing global teams of security professionals.
 </li>
 <li>
 Program Management: Proven track record involving collaboration with engineering, technology, second line risk functions and audit partners to deliver projects and facilitate resolution of audit issues within committed timelines.
 </li>
 <li>
 Communication: Exceptional written and oral communication skills, with the ability to articulate complex technical risks and solutions clearly to both technical and executive audiences.
 </li>
 <li>
 Risk Management: Expertise in performing risk assessments, identifying gaps in compliance with information security policies, and recommending effective mitigation strategies.
 </li>
 <li>
 Security Standards: Familiarity with leading security standards and frameworks such as NIST, OWASP, SANS Top 20, PCI DSS, and CIS Controls.
 </li>
 <li>
 Technical Depth: Expertise in Technology Risk data analytics (metrics reporting and dashboarding) and Reviewing Software Development Lifecycle best practices e.g., code reviews, vulnerability scan report analysis to advise application development teams on for secure practices and frameworks, and other application security best practices
 
 
 </li>
 </ul>
 
 Preferred Qualifications
 
 
 
 <ul>
 <li>
 BS or MS degree in Computer Science, Cyber Security, Information Security, or a related technical field.
 </li>
 <li>
 Relevant industry certifications such as CISSP , CISM , CRISC , CISA, or cloud-specific security certifications (e.g., AWS Certified Security &ndash; Specialty).
 </li>
 <li>
 Experience with leveraging AI/ML to solve security problems and scale operations.
 </li>
 <li>
 Knowledge of secure coding languages (e.g., Python, Java, Go).
 
 
 </li>
 </ul>
 
 About Goldman Sachs
 
 
 
 At Goldman Sachs, we commit our people, capital and ideas to help our clients, shareholders and the communities we serve to grow. Founded in 1869, we are a leading global investment banking, securities and investment management firm. Headquartered in New York, we maintain offices around the world.
 
 
 We believe who you are makes you better at what you do. We're committed to fostering and advancing diversity and inclusion in our own workplace and beyond by ensuring every individual within our firm has a number of opportunities to grow professionally and personally, from our training and development opportunities and firmwide networks to benefits, wellness and personal finance offerings and mindfulness programs. Learn more about our culture, benefits, and people at GS.com/careers.
 
 
 We&rsquo;re committed to finding reasonable accommodations for candidates with special needs or disabilities during our recruiting process. Learn more: https://www.goldmansachs.com/careers/footer/disability-statement.html
 
 
 &copy; The Goldman Sachs Group, Inc., 2023. All rights reserved.
 
 
 Goldman Sachs is an equal opportunity employer and does not discriminate on the basis of race, color, religion, sex, national origin, age, veterans status, disability, or any other characteristic protected by applicable law.
</div>

Asset & Wealth Management - Doha - Vice President - Lead Security Engineering

PayPal

<div>The Company
PayPal has been revolutionizing commerce globally for more than 25 years. Creating innovative experiences that make moving money, selling, and shopping simple, personalized, and secure, PayPal empowers consumers and businesses in approximately 200 markets to join and thrive in the global economy.
We operate a global, two-sided network at scale that connects hundreds of millions of merchants and consumers. We help merchants and consumers connect, transact, and complete payments, whether they are online or in person. PayPal is more than a connection to third-party payment networks. We provide proprietary payment solutions accepted by merchants that enable the completion of payments on our platform on behalf of our customers.
We offer our customers the flexibility to use their accounts to purchase and receive payments for goods and services, as well as the ability to transfer and withdraw funds. We enable consumers to exchange funds more safely with merchants using a variety of funding sources, which may include a bank account, a PayPal or Venmo account balance, PayPal and Venmo branded credit products, a credit card, a debit card, certain cryptocurrencies, or other stored value products such as gift cards, and eligible credit card rewards. Our PayPal, Venmo, and Xoom products also make it safer and simpler for friends and family to transfer funds to each other. We offer merchants an end-to-end payments solution that provides authorization and settlement capabilities, as well as instant access to funds and payouts. We also help merchants connect with their customers, process exchanges and returns, and manage risk. We enable consumers to engage in cross-border shopping and merchants to extend their global reach while reducing the complexity and friction involved in enabling cross-border trade.
Our beliefs are the foundation for how we conduct business every day. We live each day guided by our core values of Inclusion, Innovation, Collaboration, and Wellness. Together, our values ensure that we work together as one global team with our customers at the center of everything we do &ndash; and they push us to ensure we take care of ourselves, each other, and our communities.
Job Summary:
The team&rsquo;s main goal is to identify security vulnerabilities in PayPal&rsquo;s code and applications, and to proactively prevent them by adding security controls across PayPal&rsquo;s development eco-system. 
This role is managing a team of engineers integrating, supporting, and developing a number of product security scanners. This includes COTS solutions, as well as some open source or internally developed scanners. The team is also responsible for developing security controls to be integrated within PayPal&rsquo;s code, frameworks, and environments. 
The team&rsquo;s work combines security engineering, with software and system engineering.
Job Description:
Essential Responsibilities:
<ul><li>Leverage specialized security expertise to identify and resolve complex security issues, recommending best practices and determining new approaches that have an impact on broader security operations, while aligning security strategies with business priorities</li><li>
Partner across teams and key stakeholders to drive security initiatives, leading and solutioning complex projects and programs to strengthen overall security posture.</li><li>
Apply advanced analytical skills and sound judgment to solve security challenges, considering diverse perspectives and innovative solutions. Stay current with industry trends and emerging technologies, understanding their security implications to the company&rsquo;s context.</li><li>
Directly contribute to improvements within the security domain and occasionally beyond, ensuring decisions lead to meaningful enhancements in security practices.</li><li>
Leverage relationships across teams, both within and outside of security, to influence initiatives and integrate feedback into security processes.</li><li>
Develop and articulate clear plans and priorities for the team, guiding them to achieve security objectives while fostering a collaborative and high-performance environment.</li><li>
Lead by example, providing mentorship and support to ensure the team successfully executes on initiatives and goals.</li></ul>
Minimum Qualifications:<ul><li>
5+ years relevant experience and a Bachelor&rsquo;s degree OR Any equivalent combination of education and experience.</li></ul><div><div><div><div><div><div><div><div><div><div><div>
Additional Responsibilities &amp; Preferred Qualifications:</div></div></div></div></div></div></div></div></div></div></div><ul><li>At least 10 years of experience in application security or software development</li><li>At least 2 years of experience in a management role</li><li>Programming experience in at least one language such as Java, Python, JavaScript, Ruby, Go</li><li>Knowledge of OWASP top 10 and a deep understanding of web application and mobile application vulnerabilities</li><li>A strong familiarity with application security scanners such as SAST, SCA, DAST</li><li>Working knowledge Git, common CI/CD pipelines, and other standard developer tools</li><li>Proficiency in mentoring, providing feedback, and guiding engineers that you manage.</li><li>Strong collaboration skills with stakeholders across multiple disciplines.</li><li>Working knowledge of major cloud platforms such as Google Cloud, AWS, Azure &ndash; an advantage.</li><li>Industry certifications (e.g., CISSP, CISM, CSSLP, GWEB, or equivalent) &ndash; an advantage.</li><li>Familiarity with iOS, Android and browser SDK development &ndash; an advantage.</li></ul>
Subsidiary:
PayPal
Travel Percent:
0<ul><li></li></ul>
The base pay for this role will depend on where you work and the relevant experience and expertise you bring. The expected range of pay for this role by location is:
Primary Location | Pay Range:
Austin, Texas | ($160,500.00 - $238,700.00 Annually)
Additional Location(s) | Pay Range:
No other locations are assigned to this requisition currently.
Additional compensation for this role may include an annual performance bonus, equity, or other incentive compensation, as applicable.
PayPal does not charge candidates any fees for courses, applications, resume reviews, interviews, background checks, or onboarding. When making an application directly, we will never ask you to share passwords, one-time passcodes (OTP), or verification codes. Any such request is a red flag and likely part of a scam. All communication regarding your application will come from official PayPal email domains. If you suspect fraudulent activity, please report it immediately. To learn more about how to identify and avoid recruitment fraud please visit https://careers.pypl.com/contact-us.
For the majority of employees, PayPal's balanced hybrid work model offers 3 days in the office for effective in-person collaboration and 2 days at your choice of either the PayPal office or your home workspace, ensuring that you equally have the benefits and conveniences of both locations.
Our Benefits:
At PayPal, we&rsquo;re committed to building an equitable and inclusive global economy. And we can&rsquo;t do this without our most important asset-you. That&rsquo;s why we offer comprehensive, choice-based programs, to support all aspects of personal wellbeing&mdash;physical, emotional, and financial&mdash;delivering meaningful value where it matters most. We strive to create a flexible, balanced work culture with a holistic approach to benefits, including generous paid time off, healthcare coverage for you and your family, and resources to create financial security and support your mental health.
Who We Are: 
Commitment to Diversity and Inclusion
PayPal provides equal employment opportunity (EEO) to all persons regardless of age, color, national origin, citizenship status, physical or mental disability, race, religion, creed, gender, sex, pregnancy, sexual orientation, gender identity and/or expression, genetic information, marital status, status with regard to public assistance, veteran status, or any other characteristic protected by federal, state, or local law. In addition, PayPal will provide reasonable accommodations for qualified individuals with disabilities. If you are unable to submit an application because of incompatible assistive technology or a disability, please contact us at paypalglobaltalentacquisition@paypal.com.
Belonging at PayPal:
Our employees are central to advancing our mission, and we strive to create an environment where everyone can do their best work with a sense of purpose and belonging. Belonging at PayPal means creating a workplace with a sense of acceptance and security where all employees feel included and valued. We are proud to have a diverse workforce reflective of the merchants, consumers, and communities that we serve, and we continue to take tangible actions to cultivate inclusivity and belonging at PayPal.
Any general requests for consideration of your skills, please Join our Talent Community.
We know the confidence gap and imposter syndrome can get in the way of meeting spectacular candidates. Please don&rsquo;t hesitate to apply.</div>

Product Security Engineering Manager

ARPU Telecommunication services

<div>Objective: (summary about the position) 
Seeking a highly experienced Security Lead Engineer to lead the design, implementation, and continuous improvement of cybersecurity measures across our hybrid environment. This role requires overseeing infrastructure, application, and cloud security; managing threat detection and response systems; guiding the security posture of internally developed software; and ensuring regulatory compliance through GRC frameworks. The ideal candidate brings technical depth, leadership capabilities, and a proactive mindset to protect our digital assets and business operations. 
Responsibilities: 
1. Security Architecture &amp; Strategy<ul>
<li>Design, integrate, and maintain end-to-end security architecture for on-premises and cloud environments.</li>
<li>Ensure secure network topology including segmentation, access control, and VPN tunnels.</li>
<li>Lead development and enforcement of security policies, procedures, and best practices.</li>
<li>Work closely with developers and IT architects to embed security into application and infrastructure design.</li>
</ul>2. SOC, SIEM, and Threat Management<ul>
<li>Oversee the operation and tuning of Security Operations Center (SOC) including SIEM platforms.</li>
<li>Manage endpoint protection through EDR and threat-hunting solutions.</li>
<li>Manage and enhance email security systems to protect against phishing, malware, and spam, ensuring compliance with organizational security policies.</li>
<li>Lead incident response efforts and develop threat prevention strategies.</li>
</ul>3. Application and Cloud Security<ul>
<li>Supervise vulnerability scanning and penetration testing for internally developed applications.</li>
<li>Lead WAF deployment and optimization to protect business-critical web applications.</li>
<li>Implement security best practices and policy enforcement across multi-cloud environments</li></ul> 
4. Governance, Risk &amp; Compliance (GRC)<ul>
<li>Drive cybersecurity-related compliance programs (e.g., SOC 2 Type 2, ISO 27001).</li>
<li>Lead cross-functional GRC initiatives and support internal/external audits.</li>
<li>Manage security risk assessments and recommend mitigation strategies.</li>
</ul>5. Documentation &amp; Collaboration<ul>
<li>Maintain detailed documentation for security controls, policies, systems, and incidents.</li>
<li>Plan and conduct quarterly security awareness sessions to educate staff on emerging cyber threats, security best practices, and the organization's security policies.</li>
<li>Work collaboratively with software engineers, network teams, DevOps, and business units.</li> 
</ul> 
 
Requirements 
Min requirements:
1. Education: Bachelor&rsquo;s degree in engineering, Computer Science, Information Security or a related field. 
2. Experience:<ul><li>7 years in cybersecurity and information security roles.</li><li>5+ years of hands-on experience in security architecture and threat management.</li></ul> 
3. Qualifications necessary for the vacancy.<ul><li>Proven expertise in:</li></ul>
o Security architecture for hybrid cloud/on-prem setups.
o Firewalls, WAF, EDR, SIEM, UTM, IPS, Proxy, and DDoS mitigation.
o Network security protocols, subnetting, VPNs, and access control models. 
4. Set of skills necessary for the vacancy.<ul><li>Problem-Solving and Analytical Skills:</li></ul>
o Ability to diagnose and resolve complex technical issues efficiently.
o Skilled in designing and implementing scalable and secure IT solutions.<ul><li>Organizational Skills:</li></ul>
o Strong ability to manage multiple projects and prioritize tasks effectively.
o Commitment to meeting deadlines and maintaining high-quality standards.<ul><li>Communication and Teamwork:</li></ul>
o Excellent written and verbal communication skills.
o Ability to collaborate effectively with team members and stakeholders. 
5. Certifications (Desirable):<ul><li>CISSP, CISM, CEH, OSCP, CCSP</li><li>Cloud security certifications (e.g., AWS Security Specialty, Microsoft SC-100/SC-200)</li><li>IT governance certifications (e.g., ISO 27001 LA, CISA)</li></ul></div>

Cyber Security Lead Engineer

Oasys

<div><div>Who We Are: Oasys International LLC (Oasys) is a fast-growing federal government contractor delivering high-quality technology consulting and professional services to civilian, defense, and homeland security agencies. We have been recognized on Inc. 5000&rsquo;s list of the fastest-growing companies in America for five consecutive years and named a Best Places to Work in Virginia for the past two years.</div><div></div><div> 
Our success is driven by a talented team of technologists, consultants, engineers, and subject-matter experts who support complex federal missions with integrity and excellence. At Oasys, we foster a collaborative, merit-based culture that values continuous learning, professional growth, and work-life balance. We are committed to creating an inclusive, engaging environment where employees are recognized for their contributions and empowered to build meaningful, long-term careers.</div><div></div><div> 
Position Summary:</div><div>
The Application Security Engineer position supports secure application development and cybersecurity operations for Federal DoD programs. The role requires a deep expertise in application security, software development, federal cybersecurity standards, and secure architecture. Will be responsible for senior-level leadership in information security, secure SDLC integration, and compliance with federal security frameworks such as NIST 800‑53, NIST 800‑37 RMF, FedRAMP, and agency-specific security baselines.</div><div></div><div> 
NOTE: This role is contingent on the contract being awarded.</div><div></div><div> 
Primary Responsibilities:</div><div><ul><li>
Serve as the primary application security SME for the project, ensuring compliance with NIST, FISMA, FedRAMP, DHS, DoD, and agency-specific security requirements.</li><li>
Guide system teams through Risk Management Framework (RMF) steps related to application security, including control implementation, evidence gathering, and POA&amp;M mitigation.</li><li>
Lead security architecture reviews for mission-critical systems, ensuring secure-by-design principles across federal systems and networks.</li><li>
Integrate security into the federal SDLC by defining secure coding standards, conducting code reviews, and providing architectural input.</li><li>
Conduct and lead advanced security testing.</li><li>
Provide CISSP-level expertise on risk evaluation, compensating controls, and secure architecture guidance.</li><li>
Guide enterprise risk posture by advising leadership on vulnerabilities, mitigations, and long-term remediation planning.</li><li>
Ensure secure configurations of cloud resources within AWS GovCloud FedRAMP environments.</li><li>
All other duties as assigned by management.</li></ul></div><div></div><div> 
Skills and Qualifications:</div><div><ul><li>
Bachelor&rsquo;s degree in computer science or related field</li><li>
10 years in application development and IT security</li><li>
Experience performing risk assessments for Federal systems in AWS GovCloud</li><li>
Experience supporting FedRAMP High/Moderate systems</li><li>
Knowledge in Java, Python, HTML, SQL, CSS and cloud computing</li><li>
Excellent communication and management skills.</li></ul></div><div></div><div> 
Certifications Required:</div><div><ul><li>
Certified Secure Software Lifecycle Professional (CSSLP)</li><li>
Certified Information Systems Security Professional (CISSP)</li><li>
CompTIA Security +</li></ul></div><div></div><div> 
Certifications Preferred:</div><div><ul><li>
Certified Ethical Hacker (CEH)</li></ul></div><div></div><div> 
Security Clearance Requirements:</div><div><ul><li>
Must be a U.S. Citizen</li><li>
Must have an active DoD Secret clearance.</li></ul></div><div></div><div> 
Work Location:</div><div><ul><li>
Fairfax, VA &ndash; Corporate Headquarters (Hybrid)</li></ul></div><div></div><div> 
Oasys is proud to be an equal opportunity employer for all protected groups, including protected veterans and individuals with disabilities.</div></div>

Application Security Engineer

Search 10000+ Application security lead jobs near you this March. New roles added regularly across leading industries. Apply today.

10000 application security lead jobs Near Me

AVP, Product Security Architect

AVP, Product Security Architect

Asset & Wealth Management - Doha - Vice President - Lead Security Engineering

AVP, Product Security Architect

Product Security Engineering Manager

Cyber Security Lead Engineer

Application Security Engineer