application security specialist

CENCORE LLC

<div><p>This<b> Access Control Specialist</b> role supports secure site operations by controlling access to restricted areas, verifying credentials, monitoring entry and exit activity, and providing professional customer service to employees and visitors.<br>
<br>
<b>Responsibilities:</b></p>
<ul><li>
Control employee and visitor access to restricted areas by verifying credentials and authorizations.</li><li>
Prevent unauthorized entry and the removal of prohibited or restricted items from the premises.</li><li>
Maintain continuous surveillance of assigned areas and report issues or irregular activity promptly.</li><li>
Provide high-quality customer service to employees and visitors while maintaining site security protocols.</li><li>
Remain alert, vigilant, and situationally aware throughout the assigned shift.</li><li>
Communicate clearly and professionally in all interactions, both verbal and nonverbal.</li><li>
Apply strong attention to detail to ensure all access control procedures and security protocols are followed.</li><li>
Work independently and make sound decisions during assigned shifts.</li><li>
Adapt effectively to changing conditions in both fast-paced and routine environments.</li></ul><p><b>
Qualifications:</b></p>
<ul><li>
Active Top Secret clearance with Polygraph required.</li><li>
Must have and maintain a valid state driver's license in good standing.</li><li>
High school diploma or GED required.</li><li>
U.S. citizenship required.</li><li>
Must be able to read, speak, and understand English fluently.</li></ul>
<p><b>
Preferred Qualifications:</b></p>
<ul><li>
Experience working in government or military facilities preferred.</li><li>
Familiarity with government security regulations and access control systems preferred.</li><li>
Additional security-related certifications preferred.</li></ul>
<p><b>
Physical Requirements:</b></p>
<ul><li>
Ability to walk 3 to 5 miles during a shift.</li><li>
Ability to stand for up to 60 minutes at a time.</li><li>
Occasional ladder climbing.</li><li>
Frequent climbing of stairs and/or ramps.</li><li>
Ability to stand for prolonged periods.</li><li>
Occasional lifting of up to 50 lbs. / 22.5 kg.</li><li>
Occasional pushing or pulling of 50 to 75 lbs. / 22.5 to 34 kg. with an assistive device.</li><li><ul><li>Normal visual acuity (near, far, and peripheral, with correction).</li><li>Normal color vision for electrical work.</li></ul></li></ul>
<ul><li><i>Normal is defined according to standard medical terminology and applicable criteria.</i></li></ul><p><b>
Company Overview:</b></p>
<p>
At CenCore Group, we elevate security solutions beyond the industry standard to our exclusive CenCore standard. As a top-tier provider in the rapidly evolving intelligence community, CenCore Group is at the forefront of designing, building, securing, and maintaining AI ecosystems where big technology meets national security. With a track record of proven performance in the NatSec space, we have become the trusted source for insight, analysis, and the implementation of both physical and digital security solutions. Our company is experiencing massive growth, driven by our strong leadership and exceptional work culture. We are currently seeking a reliable, cleared professional to join our dedicated team as an Access Control Specialist.</p><br>
<p></p>
<p>
Cencore Group is an equal opportunity employer and values diversity in its workforce. We offer a competitive salary, benefits package, and opportunities for professional growth. If you possess the necessary qualifications, we encourage you to apply for the position of Security Solutions Manager with our esteemed organization.</p></div>

Access Control Specialist - Utah

Openkyber

<div><p>Security Certificate Management No 5-10 Years Is Required Security Testing No 5-10 Years Is Required Security Vulnerablity Analysis No 5-10 Years Is Required Web Application Security No 5-10 Years Is Required Web Application Security and Cryptography No 5-10 Years Is Required Network Security No 5-10 Years Is Required Information Management and Security No 5-10 Years Is Required AWS Security Architect No At least 1 year Nice To Have DB Security No At least 1 year Nice To Have File Vault/Storage Management &amp; Security Management No 2-5 Years Is Required Information Management &amp; Security No NA Nice To Have</p>
<p><b>For applications and inquiries, contact:</b> hirings@openkyber.com</p></div>

OCI Storage Engineer

Access Control Specialist - Alaska

Instabug

<div><p><b>Job Purpose<br>
</b><br>
<br>
</p><p>As an Application Security Engineer at Luciq, you will help shape and build our application security program alongside the wider team. This is a hands-on, high-ownership role where you will work closely with product and development teams across the full software development lifecycle &mdash; reviewing designs before code is written, identifying risks as features take shape, and ensuring security is embedded into how we build and ship software, not bolted on after the fact. Our stack runs on Ruby on Rails, Go, and Python, deployed on AWS with Terraform managing infrastructure as code and Jenkins powering CI/CD. You will read and review code in these languages &mdash; not just rely on scanner output &mdash; and work with AWS security services (SecurityHub, Inspector, GuardDuty, CloudTrail, CloudFront) to provide visibility and protection across our infrastructure. The role spans web applications, APIs, our mobile SDK (iOS and Android), cloud, and CI/CD &mdash; partnering with engineers, PMs, Platform, and the Security team to make the secure path the default path. This role can be filled at mid-level with a clear growth path to senior-level as you grow into shaping our application security program, or at senior-level if you're already operating at that scope.
</p><p>You will join a lean Security team, which entails stepping beyond core AppSec for incident triage, addressing customer security questionnaires, or supporting cross-functional cloud and compliance reviews. We value this variety as a core facet of the role; if you are seeking hyper-specialized work restricted strictly to application security, this may not be the right fit.<br>
</p><p></p><br>
<br>
<p>Job Responsibilities
</p><ul><li><b>Secure Design &amp; Code Review
</b></li></ul><ul><li><div><ul><li>Run and lead threat modeling sessions with product and engineering teams during feature design. This is a hands-on role with expectations to deliver fixes in the product as needed while enabling other engineers.
</li><li>Conduct security code reviews and architecture reviews across web applications, APIs, and services in Ruby, Go, and Python
</li><li>Leverage AI and make sure that we enable engineers to adhere to security acceptance criteria. Provide guidance to engineers on secure design as we iterate and build the product.
</li></ul></div></li></ul><ul><li><b>Vulnerability Management
</b></li></ul><ul><li><div><ul><li>Validate, triage, and drive remediation of vulnerabilities &mdash; partner with engineering teams across the full lifecycle from discovery through SLA support
</li><li>Coordinate with engineering teams on fix verification and root-cause prevention
</li></ul></div></li></ul><ul><li><b>Security Automation in CI/CD
</b></li></ul><ul><li><div><ul><li>Build and maintain automated security testing in CI/CD &mdash; SAST, SCA, secret scanning
</li><li>Tune tooling for signal over noise; integrate findings into developer workflows
</li><li>Operate secret-scanning and leaked-credential response workflows
</li></ul></div></li></ul><ul><li><b>Cloud &amp; Infrastructure Security
</b></li></ul><ul><li><div><ul><li>Support cloud security reviews &mdash; IAM policies, network segmentation, container/Kubernetes configurations, and Terraform policy-as-code
</li><li>Work with AWS security services (SecurityHub, Inspector, GuardDuty, CloudTrail, CloudFront) to maintain visibility and detection across our infrastructure
</li></ul></div></li></ul><ul><li><b>Supply Chain &amp; Build Security
</b></li></ul><ul><li><div><ul><li>Own dependency risk via SCA, lockfiles, and pinning
</li><li>Drive CI/CD pipeline hardening &mdash; build runners, OIDC-to-cloud, artifact signing, SBOM standards
</li></ul></div></li></ul><ul><li><b>Cross-functional Security Enablement
</b></li></ul><ul><li><div><ul><li>Develop secure coding guidelines and reusable patterns that make the secure path the default
</li><li>Drive S-SDLC adoption across engineering teams
</li><li>Review security posture of our mobile SDK across iOS and Android &mdash; data handling, transport security, local storage, IPC, encryption, third-party dependency risk, and SDK consumer-facing security defaults
</li><li>Assess security risks in AI/LLM integrations &mdash; prompt injection, insecure output handling, trust boundaries in agentic architectures
</li><li>Support compliance initiatives (SOC 2, ISO 27001) &mdash; translate control requirements into engineering practices and assist with audit evidence collection
</li>Use AI tooling actively in your own workflow AI-assisted code review, threat modeling drafts, vulnerability research, and security artifact generation and help shape how the rest of engineering uses AI safely<br>
<li>
</li></ul></div></li></ul><p></p><br>
<br>
<p><b>Job Requirements<br>
</b></p><p></p><br>
<p><b>Must-Haves
</b></p><ul><li><b>Experience </b>: 3-6 years in application security, or security engineering
</li><li><b>Education </b>: Bachelor's degree in Computer Science, Information Security, or equivalent practical experience
</li><li><b>Secure code review </b>in at least one of: Python, Ruby, Go &mdash; can read code and reason about vulnerabilities, not rely on scanner output
</li><li><b>OWASP Top 10 (Web and API) </b>as root-cause patterns, not a memorized checklist &mdash; including SSRF, insecure deserialization, injection classes, and access-control flaws
</li><li><b>Threat modeling </b>: practical experience with STRIDE and data flow diagrams; can lead a session with a product team and produce actionable output
</li><li><b>Auth and identity </b>: working depth in session management, RBAC/ABAC models
</li><li><b>CI/CD security automation </b>: hands-on experience integrating SAST, SCA, and secret scanning into pipelines and tuning for actionable signal
</li><li><b>Proactive and ownership-driven </b>&mdash; does not wait to be told what to secure
</li><li>Comfortable working <b>cross-functionally </b>with product engineers, platform engineers, and the wider team
</li><li>Strong <b>analytical and problem-solving </b>abilities
</li><li>Fluent in <b>English </b>, with strong written and verbal communication
<br>
</li><li><b>Communication </b>: clear written and verbal communication can explain a vulnerability to an engineer, a PM, or a VP<br>
<br>
<br>
</li></ul><p><b>Strong Plus
</b></p><p>We expect strong candidates to have <i>some </i>of these not all. The more, the better.
</p><ul><li><b>Mobile SDK security </b>: OWASP Mobile Top 10 and MASVS/MASTG; Android (Kotlin) or iOS (Swift); experience with Frida, objection, or MobSF
</li><li><b>AWS security service depth </b>: SecurityHub, Inspector, GuardDuty, CloudTrail, CloudFront beyond IAM
</li><li><b>Container and Kubernetes </b>security fundamentals
</li><li><b>Supply chain depth </b>: SLSA framework, SBOM <b>AI/LLM security </b>: prompt injection mitigations, OWASP LLM Top 10, securing agentic architectures and tool-use boundaries
</li><li>Familiarity with <b>ISO 27001 or SOC 2 </b>.<br>
<br>
<br>
</li></ul><p><b>Nice to Have
</b></p><ul><li>Terraform and policy-as-code: tfsec, Checkov, OPA/Conftest
</li><li>Experience building or bootstrapping a security program
</li><li>Bug bounty participation, published CVEs, or documented security research
</li><li>Hands-on certifications: OSCP, OSWE, eMAPT
</li><li>Incident response experience &mdash; triage, containment, root-cause analysis
</li><li>Red teaming or purple teaming experience</li></ul></div>

Application Security Engineer

Toyota North America

<div><p><b>Overview</b></p><p></p><p><b>
Who we are</b></p><p></p><div><p>
Collaborative. Respectful. A place to dream and do. These are just a few words that describe what life is like at Toyota. As one of the world&rsquo;s most admired brands, Toyota is growing and leading the future of mobility through innovative, high-quality solutions designed to enhance lives and delight those we serve. We&rsquo;re looking for talented team members who want to Dream. Do. Grow. with us.</p><p></p><p>
An important part of the Toyota family is Toyota Financial Services (TFS), the finance and insurance brand for Toyota and Lexus in North America. While TFS is a separate business entity, it is an essential part of this world-changing company- delivering on Toyota's vision to move people beyond what's possible. At TFS, you will help create best-in-class customer experience in an innovative, collaborative environment.</p></div><p></p><p><b>
To save time applying, Toyota does not offer sponsorship of job applicants for employment-based visas or any other work authorization for this position at this time.</b></p><p></p><p><b>
Who we&rsquo;re looking for</b></p><p>
Toyota Financial Services (TFS) Technology team is looking for a highly motivated person to fill a role as a Application Security Analyst. Your responsibilities will be to ensure the security of company software applications, web services, and APIs. You will work closely with development teams to identify vulnerabilities, suggest remediation efforts, and integrate security controls into the DevOps pipeline. The role involves ensuring the security and integrity of our products and third-party software, providing guidance on security risks.</p><p></p><p><b>
What you&rsquo;ll be doing</b></p><ul><li><p>
Collaborate with developers to &quot;shift left&quot;&mdash;integrating security early in the software development life cycle (SDLC)</p></li><li><p>
Integrate security tools like SAST, DAST, and SCA into development processes.</p></li><li><p>
Review code for security vulnerabilities and provide guidance to developers on remediation and secure coding practices.</p></li><li><p>
Prepare detailed vulnerability reports and dashboards for leadership, prioritizing risks based on business impact.</p></li><li><p>
Stay updated on emerging threats and vulnerabilities relevant to application security.</p></li><li><p>
Provide guidance and training on interpreting reports and strategies for remediation.</p></li></ul><p></p><p><b>
What you bring</b></p><ul><li><p>
Typically, 3-6 years of experience in application security, with significant hands-on experience using SAST/SCA/DAST tools and methodologies.</p></li><li><p>
Proven expertise in testing complex web applications, APIs, and mobile applications for security vulnerabilities.</p></li><li><p>
Strong understanding of application security standards (e.g., OWASP Top Ten, SANS CWE Top 25).</p></li><li><p>
Familiarity with programming languages and frameworks commonly used in web and mobile applications, including Java, Python, Bash/Shell Scripting, PHP, Javascript, etc.</p></li><li><p>
Strong understanding of CI/CD tools (e.g., Jenkins, Harness, GHA).</p></li><li><p>
Familiarity with containerization and orchestration (Docker, Kubernetes).</p></li><li><p>
Knowledge of cloud platforms (AWS, Azure, GCP) and their security features.</p></li><li><p>
Knowledge of Infrastructure as Code (Terraform, Ansible).</p></li></ul><p></p><p><b>
Added bonus if you have</b></p><ul><li><p>
Strong analytical and problem-solving skills.</p></li><li><p>
Excellent communication and collaboration abilities.</p></li><li><p>
Ability to work in a fast-paced, agile environment.</p></li><li><p>
Ability to lead security testing initiatives and mentor junior security engineers.</p></li></ul><p></p><p><b>
What we&rsquo;ll bring</b></p><p>
During your interview process, our team will provide detailed information about our industry-leading benefits and career development opportunities. Here are a few highlights:</p><ul><li><p>
A work environment built on teamwork, flexibility, and respect.</p></li><li><p>
Professional growth and development programs to help advance your career, including tuition reimbursement.</p></li><li><p>
Team Member Vehicle Purchase Discount.</p></li><li><p>
Toyota Team Member Lease Vehicle Program (if applicable).</p></li><li><p>
Comprehensive health care and wellness plans for your entire family.</p></li><li><p>
Toyota 401(k) Savings Plan with a company match, plus an annual retirement contribution from Toyota regardless of your own contributions.</p></li><li><p>
Paid holidays and paid time off.</p></li><li><p>
Referral services for prenatal services, adoption, childcare, schools, and more.</p></li><li><p>
Tax advantaged Accounts (Health Savings Account, Health Care FSA, Dependent Care FSA).</p></li><li><p>
Relocation assistance (if applicable).</p></li></ul><p></p><p><b>
Belonging at Toyota</b></p><p></p><p>
Our success begins and ends with our people. We embrace all perspectives and value unique human experiences. Respect for all is our North Star. Toyota is proud to have 10+ different Business Partnering Groups across 100 different North American chapter locations that support team members&rsquo; efforts to dream, do and grow without questioning that they belong.</p><p></p><p>
Applicants for our positions are considered without regard to race, ethnicity, national origin, sex, sexual orientation, gender identity or expression, age, disability, religion, military or veteran status, or any other characteristics protected by law.</p><p></p><p>
Have a question, need assistance with your application or do you require any special accommodations? Please send an email to talent.acquisition@toyota.com.</p></div>

Application Security Analyst

PackageX

<div>
 <strong>
  About PackageX
 </strong>
 :
 <br/>
 <br/>
 PackageX is the execution layer for physical AI in enterprise logistics. We enable enterprises to see, understand, and execute real-world logistics operations in real time using Vision-Language-Action intelligence.
 <br/>
 <br/>
 We sit between systems of record (ERP, WMS, TMS) and the physical world, turning cameras, people, and automation into deterministic, auditable workflows. Rather than replacing existing systems, PackageX makes them operationally intelligent.
 <br/>
 <br/>
 We start with inbound receiving, the highest-friction choke point in logistics, and expand across adjacent workflows, sites, and automation modes. This creates a workflow-led enterprise expansion motion that compounds inside complex operations.
 <br/>
 <br/>
 We're a fast-growing pre-Series A stage startup in New York City with a distributed global team backed by Bullpen Capital, Pritzker Group, Sierra Ventures, Ludlow Ventures, MXV Capital, and NSV Wolf Capital.
 <br/>
 <br/>
 <strong>
  What We Are Looking For
  <br/>
  <br/>
 </strong>
 We&rsquo;re looking for a security engineer who is serious about their craft and genuinely curious about where the field is heading. This role sits at the intersection of traditional application security and the new challenges that come with building AI-powered products. You&rsquo;ll own security end-to-end, from hardening our cloud infrastructure and reviewing code, to thinking through what it means to secure systems that use large language models. You don&rsquo;t need to have done this exact job before, but you should be the kind of engineer who stays curious, learns fast, and cares deeply about getting things right.
 <br/>
 <br/>
 <strong>
  You will:
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Own security across the SDLC from threat modeling during design, to security reviews during development, to vulnerability scanning in CI/CD. You&rsquo;ll use modern tooling (including AI-powered scanners where they genuinely help) to keep pace with a fast-moving engineering team
  </li>
  <li>
   Conduct vulnerability assessments and penetration tests across our web applications, APIs, and infrastructure. You&rsquo;ll identify issues before attackers do, document findings clearly, and work directly with developers to get them fixed
  </li>
  <li>
   Write and maintain security policies that engineers will actually follow, clear, practical, and grounded in how the team actually works, not copied from a compliance template
  </li>
  <li>
   Think carefully about the security risks that come with AI-powered products, such as prompt injection, sensitive data leaking through model outputs, and how to keep our LLM integrations safe for customers. This is a newer area, and you&rsquo;ll be helping us figure it out as we go
  </li>
  <li>
   Report on security posture to engineering leadership, tracking gaps, trends, and open issues in a way that helps the team prioritize and act, not just tick compliance boxes
  </li>
  <li>
   Review code for security issues and work closely with developers to fix them, building habits and processes so security feedback becomes a normal part of how the team ships, not a last-minute blocker
  </li>
  <li>
   Define and maintain security standards for how we build and deploy software, writing clear guidelines, putting automated checks in place, and making it easy for engineers to do the right thing by default
  </li>
  <li>
   Build automation that makes security work scale &mdash; whether that&rsquo;s smarter alerting, faster triage, or tooling that helps developers catch and fix issues without needing a security engineer in every conversation
  </li>
  <li>
   Participate in product and engineering design discussions &mdash; raising security concerns early, helping the team understand the risks, and finding solutions that don&rsquo;t slow down shipping
  </li>
  <li>
   Embed security into our CI/CD pipelines and development workflows &mdash; reducing the time between finding a vulnerability and getting it fixed, and making security a shared responsibility across the engineering team
  </li>
  <li>
   Keep up with how the security landscape is evolving &mdash; particularly as AI becomes a bigger part of how software is built and attacked. You&rsquo;ll bring that knowledge back to the team and help us stay ahead of new threats
   <br/>
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Skills and Qualification:
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   A degree in Computer Science, Information Security, or a related field
  </li>
  <li>
   3+ years of hands-on experience in application security or security engineering.
  </li>
  <li>
   Proven ability to build, manage, and monitor security in production environments where reliability matters &mdash; you&rsquo;ve operated under pressure, handled incidents, and know what it takes to keep systems safe at scale
  </li>
  <li>
   Solid experience securing web applications, APIs, and cloud infrastructure &mdash; covering areas like intrusion detection, access control design, incident response, and security policy development. You know the fundamentals well and can apply them in a real product context
  </li>
  <li>
   Experience with static and dynamic code analysis, you&rsquo;ve worked with SAST and DAST tools, know their limitations, and can help developers actually act on what those tools surface rather than just generating noise
  </li>
  <li>
   Familiarity with modern cloud architectures, serverless, microservices, and API-first designs. Bonus if you&rsquo;ve thought about what it means to secure systems that call LLM APIs or handle AI-generated outputs as part of their core workflow
  </li>
  <li>
   Strong understanding of OWASP Top 10 vulnerabilities and how to defend against them. Familiarity with the OWASP Top 10 for LLMs is a plus; we&rsquo;re building AI-powered products and need someone who can think through what that means for security
  </li>
  <li>
   Good understanding of RESTful API security, authentication, authorization, rate limiting, and input validation. Our platform is API-heavy, and we need someone who can spot the common mistakes and knows how to prevent them
  </li>
  <li>
   Strong experience in penetration testing and vulnerability analysis. You can run an assessment end-to-end, write up findings that people actually read, and follow through until issues are resolved &mdash; not just hand over a report and move on
  </li>
  <li>
   Experience working with AWS and/or GCP, securing cloud infrastructure, managing IAM policies, and understanding how cloud-native services introduce their own security considerations. We run primarily on AWS
   <br/>
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  What can you expect from the application process?
  <br/>
  <br/>
 </strong>
 All applications will be looked at by the People team, who will reach out to shortlisted candidates. Across various interview rounds, you'll speak with the hiring manager and other functional heads. We want to have an open discussion about your work and how we can be a great fit. The process may also involve an assessment or presentation relevant to the role. You can expect an offer after three rounds of interviews. All offers are subject to satisfactory reference and background checks.
 <br/>
 <br/>
 We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.
</div>


<div><div><div><div><b>About PackageX</b>:</div>
<div>
PackageX is the execution layer for physical AI in enterprise logistics. We enable enterprises to see, understand, and execute real-world logistics operations in real time using Vision&ndash;Language&ndash;Action intelligence.</div><br>
<div></div>
<div>
We sit between systems of record (ERP, WMS, TMS) and the physical world, turning cameras, people, and automation into deterministic, auditable workflows. Rather than replacing existing systems, PackageX makes them operationally intelligent.</div><br>
<div></div>
<div>
We start with inbound receiving, the highest-friction choke point in logistics, and expand across adjacent workflows, sites, and automation modes. This creates a workflow-led enterprise expansion motion that compounds inside complex operations.</div><br>
<div></div>
<div>
We're a fast-growing pre-Series A stage startup in New York City with a distributed global team backed by Bullpen Capital, Pritzker Group, Sierra Ventures, Ludlow Ventures, MXV Capital, and NSV Wolf Capital.</div><br>
<div></div>
<div><b>
What we are looking for</b></div>
<div>
We&rsquo;re looking for a security engineer who is serious about their craft and genuinely curious about where the field is heading. This role sits at the intersection of traditional application security and the new challenges that come with building AI-powered products. You&rsquo;ll own security end-to-end, from hardening our cloud infrastructure and reviewing code, to thinking through what it means to secure systems that use large language models. You don&rsquo;t need to have done this exact job before, but you should be the kind of engineer who stays curious, learns fast, and cares deeply about getting things right.</div><br>
<div></div>
<div><b>
You will:
</b></div><ul><li>Own security across the SDLC from threat modeling during design, to security reviews during development, to vulnerability scanning in CI/CD. You&rsquo;ll use modern tooling (including AI-powered scanners where they genuinely help) to keep pace with a fast-moving engineering team.</li>
<li>Conduct vulnerability assessments and penetration tests across our web applications, APIs, and infrastructure. You&rsquo;ll identify issues before attackers do, document findings clearly, and work directly with developers to get them fixed.</li>
<li>Write and maintain security policies that engineers will actually follow, clear, practical, and grounded in how the team actually works, not copied from a compliance template.</li>
<li>Think carefully about the security risks that come with AI-powered products, such as prompt injection, sensitive data leaking through model outputs, and how to keep our LLM integrations safe for customers. This is a newer area, and you&rsquo;ll be helping us figure it out as we go.</li>
<li>Report on security posture to engineering leadership, tracking gaps, trends, and open issues in a way that helps the team prioritize and act, not just tick compliance boxes.</li>
<li>Review code for security issues and work closely with developers to fix them, building habits and processes so security feedback becomes a normal part of how the team ships, not a last-minute blocker.</li>
<li>Define and maintain security standards for how we build and deploy software, writing clear guidelines, putting automated checks in place, and making it easy for engineers to do the right thing by default.</li>
<li>Build automation that makes security work scale &mdash; whether that&rsquo;s smarter alerting, faster triage, or tooling that helps developers catch and fix issues without needing a security engineer in every conversation.</li>
<li>Participate in product and engineering design discussions &mdash; raising security concerns early, helping the team understand the risks, and finding solutions that don&rsquo;t slow down shipping.</li>
<li>Embed security into our CI/CD pipelines and development workflows &mdash; reducing the time between finding a vulnerability and getting it fixed, and making security a shared responsibility across the engineering team.</li>
<li>Keep up with how the security landscape is evolving &mdash; particularly as AI becomes a bigger part of how software is built and attacked. You&rsquo;ll bring that knowledge back to the team and help us stay ahead of new threats.</li></ul><br>
<div></div>
<div><b>
Skills and Qualification:</b></div>
<ul>
<li>A degree in Computer Science, Information Security, or a related field</li>
<li>3+ years of hands-on experience in application security or security engineering.
</li><li>Proven ability to build, manage, and monitor security in production environments where reliability matters &mdash; you&rsquo;ve operated under pressure, handled incidents, and know what it takes to keep systems safe at scale.</li>
<li>Solid experience securing web applications, APIs, and cloud infrastructure &mdash; covering areas like intrusion detection, access control design, incident response, and security policy development. You know the fundamentals well and can apply them in a real product context.</li>
<li>Experience with static and dynamic code analysis, you&rsquo;ve worked with SAST and DAST tools, know their limitations, and can help developers actually act on what those tools surface rather than just generating noise.</li>
<li>Familiarity with modern cloud architectures, serverless, microservices, and API-first designs. Bonus if you&rsquo;ve thought about what it means to secure systems that call LLM APIs or handle AI-generated outputs as part of their core workflow.</li>
<li>Strong understanding of OWASP Top 10 vulnerabilities and how to defend against them. Familiarity with the OWASP Top 10 for LLMs is a plus; we&rsquo;re building AI-powered products and need someone who can think through what that means for security.</li>
<li>Good understanding of RESTful API security, authentication, authorization, rate limiting, and input validation. Our platform is API-heavy, and we need someone who can spot the common mistakes and knows how to prevent them.</li>
<li>Strong experience in penetration testing and vulnerability analysis. You can run an assessment end-to-end, write up findings that people actually read, and follow through until issues are resolved &mdash; not just hand over a report and move on.</li>
<li>Experience working with AWS and/or GCP, securing cloud infrastructure, managing IAM policies, and understanding how cloud-native services introduce their own security considerations. We run primarily on AWS.</li></ul><br>
<div></div>
<div><b>
What can you expect from the application process?</b></div>
<div>
All applications will be looked at by the People team, who will reach out to shortlisted candidates. Across various interview rounds, you'll speak with the hiring manager and other functional heads. We want to have an open discussion about your work and how we can be a great fit. The process may also involve an assessment or presentation relevant to the role. You can expect an offer after three rounds of interviews. All offers are subject to satisfactory reference and background checks.</div><br>
<p></p>
</div></div>
<div><div>We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.</div></div></div>

Search 10000+ Application security specialist jobs near you this May. New roles added regularly across leading industries. Apply today.

10000 application security specialist jobs Near Me

Access Control Specialist - Utah

OCI Storage Engineer

Access Control Specialist - Alaska

Application Security Engineer

Application Security Analyst

Application Security Engineer

Application Security Engineer