Description

Required Experience

•        Hands-on experience developing, reviewing, testing, and remediating application code in modern software environments.

•        Experience identifying and mitigating vulnerabilities in applications, APIs, open-source dependencies, container images, frameworks, runtimes, and software supply chains.

•        Strong understanding of secure software design, secure coding practices, threat modeling, and common application security risks.

•        Experience embedding security controls and approval criteria into source-control, pull-request, build, test, release, and deployment workflows.

•        Practical experience with SAST, software composition analysis, secrets detection, dependency management, container scanning, and vulnerability-management platforms.

•        Experience validating findings, assessing exploitability and business impact, reducing false positives, and defining risk-based remediation SLAs.

•        Experience securing containerized and cloud-native applications, including Docker, Kubernetes, registries, base images, and policy-as-code controls.

•        Strong scripting and automation experience using Python, PowerShell, Bash, or a comparable language.

•        Experience operating vulnerability remediation, exception and risk-acceptance processes, including compensating controls, ownership, expiration, and escalation.

•        Strong communication, problem-solving, and cross-functional leadership skills, with the ability to take ownership from discovery and baseline through implementation, stabilization, documentation, and knowledge transfer.

Responsibilities

•        Inventory and baseline in-scope applications, repositories, dependencies, container images, delivery pipelines, security-tool coverage, and end-of-life frameworks and runtimes; identify unmanaged or unscanned assets.

•        Partner with development teams to identify, prioritize, and remediate vulnerabilities in code, APIs, dependencies, container images, and application configurations.

•        Perform secure code reviews, architecture and design reviews, and application security assessments throughout the software development lifecycle.

•        Write, review, test, and submit application-code and pipeline-configuration changes required to resolve security issues.

•        Define, implement, and maintain risk-based security gates, approval criteria, automated controls, and controlled bypass processes across source-control and CI/CD workflows.

•        Configure and tune application security tooling to improve coverage, accuracy, maintainability, developer usability, and false-positive rates; recommend whether tools should be retained or retired.

•        Establish secure development standards, remediation SLAs, finding-routing rules, and an application-security exception register with compensating controls, owners, expiration dates, and escalation paths.

•        Develop automation for repository and pipeline coverage monitoring, finding intake, triage, ownership assignment, overdue remediation, failed gates, expired exceptions, reporting, and escalation.

•        Support container and Kubernetes security through dependency and base-image currency practices, image governance, workload controls, and policy-as-code enforcement.

•        Define, track, and report application security KPIs, including scanner coverage, remediation performance, gate effectiveness, backlog and exception aging, and end-of-life technology risk; create runbooks, operating documentation, training, and knowledge transfer materials.

Qualifications

•        Strong software development skills in one or more modern programming languages; C# and .NET experience is highly desirable.

•        Deep understanding of application architecture, web applications, APIs, microservices, authentication, authorization, secrets management, and secure coding principles.

•        Experience with Git, GitHub, Jenkins, GitOps workflows, and modern CI/CD platforms; familiarity with Flux is desirable.

•        Experience with tools such as Aikido, SonarQube, Gitleaks, Trivy, Renovate, or equivalent application security technologies.

•        Experience with Docker, Kubernetes, container registries, and policy-as-code frameworks such as Kyverno.

•        Understanding of software supply-chain security, dependency and base-image lifecycle management, artifact integrity, and end-of-life technology risk.

•        Ability to perform root-cause analysis and establish ownership across code, dependencies, containers, pipelines, platforms, and infrastructure boundaries.

•        Ability to translate technical risk into prioritized roadmaps, measurable controls, operational reporting, and clear communication for engineering and leadership audiences.

•        Familiarity with cloud application security and cloud-native delivery patterns; AWS experience is a plus.

•        Bachelor’s degree in computer science, software engineering, cybersecurity, information systems, or equivalent professional experience; demonstrable use of AI-assisted engineering tools such as GitHub Copilot with appropriate validation and secure-development practices

Key Skills

Education

Bachelor's degree