Application Security Engineer

Description:

(6-month CTH)

• On site strongly preferred but remote for the right candidate.

Team: Cyber Defense & Engineering (CDE)

Reports To: Director, Cyber Defense & Engineering

Level:Individual Contributor

Location: Philadelphia, PA / Hybrid

About the Role

Application development at client is distributed across many engineering teams, and the company is modernizing its application portfolio and migrating workloads to the cloud. This role exists to build client application security operating model across that decentralized landscape. This is a build role. The person we are looking for will establish the capability, not inherit a mature program.

The mission is to create scalable application security capability. A minimum baseline that every development team can meet, a risk-tiering model that focuses limited effort where it matters most, automated security testing integrated into delivery pipelines, and a Security Champions network that extends security practice into the teams where code is actually written. Success is measured by the capability adopted across engineering teams, not by the volume of reviews one person performs.

This role bridges shift-left secure development practice with detection and response capabilities that reveal how applications are attacked in the real world, which grounds the engineer's secure-design guidance in genuine attack patterns and makes them a stronger partner to the teams rebuilding applications for the cloud.

This is a hands-on technical role. Expect to read unfamiliar codebases, configure tooling, lead design reviews, and triage findings. The measure of success is the operating model built and adopted across the organization, not personal throughput.

What You'll Do

• Inventory and assess the environment by cataloging applications, development pipelines, source repositories, and existing AppSec tooling across the decentralized engineering organization, so standardization starts from an accurate picture rather than an assumption.
• Create an application risk-tiering model that focuses limited application security effort on the applications carrying the most risk, so time is spent where it changes outcomes.
• Define a minimum AppSec baseline that every development team is expected to meet, regardless of their tooling or SDLC, and socialize it with engineering leadership as the common standard.
• Build and lead a Security Champions program across the decentralized product engineering teams.
• Lead threat modeling for modernization and migration including the new trust boundaries and attack surfaces introduced by monolith-to-microservices re-architecture containerization, and re-platforming.
• Provide secure-by-design guidance on migration decisions so security tradeoffs are understood before architecture is locked.
• Own application inventory, risk-tiering, and coverage metrics, alongside vulnerability and remediation metrics, so leadership can see reach and gaps across the portfolio.
• Triage and validate vulnerabilities surfaced through tooling, penetration tests, bug bounty submissions, and detection alerts, and drive remediation with the responsible engineering teams.
• Partner with Security Operations and incident response on application-layer incidents, providing technical depth on attack paths, exploit feasibility, and remediation validation.

Enable Skills-Based Hiring No Qualifications/Certifications