Sr Application Security Engineer-Remote

What does it mean to be part of the Information Technology Team?

A role in Information Technology at UNFI involves being a part of the transformation of food for all through many innovative technology products such as myUNFI, our customer ordering platform or our warehouse management systems that optimize service. You will have an opportunity to be a part of the technology journey to transform food for all through collaboration and building solutions across teams that directly contribute to our OneUNFI strategy. Roles include network automation, infrastructure unification and modernization, data services and analytics, and digital offering.

Job Responsibilities:

• Conduct security-focused code reviews, static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), and interactive application security testing (IAST)
• Triage and prioritize findings from automated security scans and penetration testing results; provide actionable remediation guidance to developers
• Collaborate with software development teams to integrate security tools and best practices into CI-CD pipelines (e.g., secret scanning, dependency checking, secure coding standards)
• Develop and maintain security tools, scripts, frameworks, and automation to scale application security efforts
• Support vulnerability assessments, penetration testing, and red team exercises on applications
• Provide security consulting and training to development teams on secure coding practices, common vulnerabilities (e.g., OWASP top 10), and emerging threats
• Monitor emerging application security trends, vulnerabilities (e.g., CVEs), and attack techniques; contribute to incident response when application exploits occur
• Ensure applications align with relevant standards and regulations (e.g., NIST, OWASP, PCI-DSS, SOC 2)
• Create and update security documentation, policies and threat models as needed
• Compiles and analyzes data for management reporting and metrics as directed
• Demonstrates expert-level knowledge and skills in the technical, process, organizational, and philosophical aspects of application security
• Performs other duties as assigned

Job Requirements:

Education / Certifications:

• BA/BS in Computer or Cybersecurity domain
• Relevant certifications such as OSCP, GWAPT, CSSLP, CEH, CISSP, or cloud security certs (e.g., AWS Security Specialty)

Experience:

• 6+ years of experience in application security, secure software development, penetration testing, or related cybersecurity roles, in a large, highly diverse, and distributed environment
• Strong understanding of web application vulnerabilities, OWASP top 10, and secure coding principles
• Proficiency in at least one or more programming languages (e.g., Python, Java, JavaScript, C#)
• Hands-on experience with AppSec tools such as:
  • SAST: SNYK, Veracode, SonarQube, Checkmarx, CodeQL
  • DAST: SNYK, OWASP ZAP, Burp Suite, Veracode
  • SCA: Snyk, Dependabot, Black Duck, OWASP Dependency-Check
  • Other: Wiz, GitHub Advanced Security, or similar
• Familiarity with cloud platforms (AWS, Azure, GCP) and container/orchestration technologies (Docker, Kubernetes)
• Experience with DevSecOps practices and integrating security into CI-CD pipelines
• Knowledge of secure SDLC methodologies, threat modeling (e.g., STRIDE, PASTA), and secure design patterns

Knowledge / Skills / Abilities:

• Excellent written, verbal, and interpersonal communication skills – able to explain technical security issues to non-technical stakeholders and collaborate effectively with developers
• Analytical mindset with strong problem-solving abilities
• Proactive, detail-oriented, and able to manage multiple priorities
• Ability to translate technical findings into actionable insights
• Ability to mentor junior staff and transfer technical knowledge as well as contribute to the team’s knowledge sharing
• Strong independent direction and ability to multi-task
• Flexible and adaptable to learning and understanding new technologies
• Ability to work extremely well under pressure while maintaining a professional image and approach
• Team player with proven ability to work effectively with other business units, IT management and staff, vendors, and consultants
• Exceptional information analysis abilities: ability to perform independent analysis and distill relevant findings and root cause
• Comfortable discussing complex findings and issues with variety of audiences, including C‑suite level
• Self-driven and able to reach deadlines on-time with minimal direction
• Passion for cybersecurity and staying current with evolving threats

Compensation Range- $150,000-$160,000

Work Environment:
Remote Role:

• This position is classified as remote where the associate will perform remote work from their primary residence. Remote associates are welcome to work from the office but are not required to do so. While remote associates are not required to work from an office on a regular basis, they may be required to come to the office or other UNFI locations for necessary business reasons or if directed to do so by their manager.

Physical Environment/Demands:
Office Roles:

• Most work is performed in a temperature-controlled office environment.
• Incumbent may sit for long periods of time at a desk or computer terminal.
• While performing the duties of this job, the employee is regularly required to sit; use hands to finger, handle, or feel; reach with hands and arms; and talk or hear.
• Incumbent may use calculators, keyboards, telephones, and other office equipment during a normal workday.
• Stooping, bending, twisting, and reaching may be required in the completion of job duties.

The above statements are intended to describe the general nature of the work performed by the employees assigned to this job. All employees must comply with Company policy and applicable laws. The responsibilities, duties and skills required of personnel so classified may vary within each department and/or location.