Application Security Engineer / Architect (DevSecOps)
$175,000–$210,000 year
HybridNew York, United States
Job Summary
Own security controls within CI/CD pipelines, including SAST, DAST, and secrets detection, while maintaining pipeline-as-code tooling. Work with engineers to identify and remediate vulnerabilities in application source code and manage the full vulnerability lifecycle from triage to trend reporting. Lead cloud security efforts by enforcing best practices for IAM, network controls, and workload protection, and partner with Infra teams to define secure infrastructure-as-code standards. Maintain and tune security tooling such as container security platforms and dependency analyzers, and build automation tools to scale DevSecOps operations. Participate in threat modeling sessions, support incident response activities, and contribute to security documentation and developer guidance.
Required Qualifications
- 7+ years of experience in a DevSecOps, application security, or cloud security engineering role
- Hands-on experience with CI/CD platforms (GitHub Actions, GitLab CI, Jenkins, or similar)
- Proficiency with at least one major cloud provider (AWS, Azure, or GCP) and its native security services
- Experience with SAST/SCA tools (e.g., Semgrep, Snyk, Checkmarx, Veracode) and interpreting findings
- Working knowledge of container and Kubernetes security (image scanning, RBAC, network policies, admission control)
- Scripting skills in Python, Bash, or similar for automation and tooling
- Familiarity with IaC tools (Terraform, CloudFormation, Pulumi) and policy frameworks (OPA/Rego, Checkov)
- Understanding of OWASP Top 10, CWE, and common vulnerability classes
- Strong communication skills — able to explain security risk clearly to non-security audiences
- We are requiring employees to be in the office 4 days per week
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.