Application Security Engineer

This is a contract-to-hire Application Security Engineer position based in Charlotte, North Carolina, for a 6-month initial term. You will take an integral role in building and scaling an application security program across multiple business units, from initial discovery through tooling deployment and ongoing operations. Success in this role requires both technical depth in application security and the relationship-building skills to influence engineering organizations and drive adoption of security practices without direct authority.

Responsibilities

• Conduct application discovery and inventory across all business units, including ownership mapping, technology stack profiling, and risk tiering.
• Stand up and operate the AppSec tooling stack - SAST, SCA, secrets scanning, and container/IaC scanning - integrated into business unit CI/CD pipelines.
• Design and implement AI-assisted triage workflows on top of AppSec tooling to prevent finding volume from overwhelming developers and filter false positives before they reach engineering teams.
• Define secure SDLC requirements, threat modeling practices, and security gates that business units adopt as part of their standard development process.
• Partner with business unit development leaders to build relationships and shared playbooks needed to operationalize AppSec without becoming a blocker to delivery.
• Contribute to AI security strategy by evaluating emerging tools (AI code review assistants, agentic security testing, automated security requirement generation) and recommending what to operationalize and what to defer.
• Produce executive-ready metrics and reporting that connect AppSec activity to business risk reduction.

Qualifications

• Required

• 7+ years in application security, product security, or security engineering, with at least 3 years in environments with multiple independent business units, brands, or product lines.

• Hands-on experience deploying and operating modern AppSec tooling such as Semgrep, Snyk, Checkmarx, Veracode, Apiiro, Ox Security, or GitHub Advanced Security.

• Working code-level proficiency in at least three commonly-used languages including Python, JavaScript/TypeScript, Java, C#, or Go, sufficient to read, review, and triage findings.

• Strong scripting and automation skills in Python or equivalent; comfortable building integrations against REST APIs and operating in CI/CD environments such as GitHub Actions, GitLab CI, Jenkins, or Azure DevOps.

• Demonstrated ability to influence engineering organizations without direct authority - negotiating standards, driving adoption, and partnering with development leaders.

• Practical understanding of OWASP Top 10, threat modeling methodologies such as STRIDE or PASTA, and modern attack patterns including supply chain risks.

• Preferred

• Experience integrating LLM-based tooling into security workflows such as alert triage, finding summarization, and remediation guidance generation.

• Familiarity with one or more compliance frameworks including HITRUST, HIPAA, NIST AI RMF, or SOC 2.

• Prior experience working in a regulated or healthcare-adjacent environment.

• Cloud security depth in at least one major provider including AWS, Azure, or GCP.

• Public contribution to the AppSec community through OSS, conference talks, published research, or detection/rule contributions.