A financial institution is seeking a Senior Application Security Engineer to lead hands-on application security initiatives across the software development lifecycle.
This role combines DevSecOps engineering, security automation, vulnerability assessment, API protection, and advanced third-party software analysis. The engineer will work closely with application development and security teams to strengthen software security controls and improve application trust.
RESPONSIBILITIES- Embed automated application security checks into CI/CD pipelines.
- Collaborate with developers on secure coding, code reviews, and threat modeling.
- Perform static and dynamic application security testing.
- Identify application vulnerabilities and work with stakeholders on remediation.
- Evaluate third-party software, source code, software dependencies, and compiled applications.
- Contribute to software trust validation and secure software approval processes.
- Assess API vulnerabilities and support WAF management.
- Incorporate threat intelligence into software risk assessments.
- Coordinate penetration testing activities and external vendor engagement.
Role Requirements- Hands-on Application Security or DevSecOps experience.
- CI/CD integration and secure software development knowledge.
- Python proficiency relevant to security engineering.
- SAST and DAST experience.
- API security and WAF knowledge.
- GitHub security tooling experience.
- Secure SDLC, threat modeling, and vulnerability management.
- Experience with third-party software risk, software composition analysis, or binary analysis.
- Knowledge of software supply chain security and threat intelligence.
- AI knowledge and strong communication skills.
PREFERRED EXPERIENCE- Banking or financial services background.
- Mandarin language skills.