Application Security Engineer
Job Description
Job title: Application Security Engineer
\n
Job type: Contract W-2
\n
Job Location: New York, New York (Hybrid- 3 days onsite)
\n
\n
A global bank is seeking a Application Security Engineer . The Application Security Engineer joins the IT Security Team (LOD1) to strengthen implementation of the IT Secure Software Development Lifecycle Framework and support development teams in remediating vulnerabilities. The role combines hands-on technical expertise with leadership, mentoring and strategic security improvement across an international development environment
\n
\n
Requirements:
\n
Contribute to the application security strategy and roadmap, and drive continuous improvement of the IT S- SDLC Framework.
\n
· Mentor and guide junior AppSec engineers.
\n
· Provide expert support and security advice to development squads, and lead complex vulnerability analysis and remediation.
\n
· Lead community animation and drive security adoption through advanced workshops, training sessions and weekly open sessions for developers.
\n
· Develop comprehensive technical documentation, training materials and security best practices.
\n
· Monitor and optimize security KPIs, KRIs and OKRs.
\n
· Conduct technology monitoring and emerging-threat analysis.
\n
· Propose innovative security solutions and develop proofs of concept
\n
\n
Requirements:
\n
Education and experience
\n
· Minimum of a master’s degree (Bac+5); engineering school or equivalent higher education preferred.
\n
· At least three years of experience in cybersecurity, application security or DevSecOps.
\n
· Proven leadership experience in application security projects.
\n
Technical expertise
\n
· Advanced proficiency in static application security testing (SAST), software composition analysis (SCA),
\n
container image scanning and dynamic application security testing (DAST).
\n
· Expertise in Infrastructure as Code (IaC) scanning and secrets detection tools.
\n
· Experience with quality assurance and security tool integration into CI/CD pipelines.
\n
· Expert-level knowledge of Python, C++, C# or another programming language.
\n
· Familiarity with development frameworks such as Hadoop and Angular.
\n
· Deep understanding of OWASP Top 10 vulnerabilities, advanced vulnerability analysis and remediation
\n
strategies, false-positive identification and optimization, and end-of-support lifecycle management.
\n
· Comprehensive knowledge of cloud security across private, public, regulated and hybrid environments.