Senior Application Security Engineer
AmTrust Financial · Cleveland, OH, US
About this role
## Senior Application Security Engineer ### Overview The Senior Application Security Engineer is a key member of the Security Assurance team responsible for identifying, assessing, and reducing security risk across applications, APIs, cloud-native platforms, and AI-enabled solutions. You’ll partner with software engineering teams to integrate security throughout the Secure Software Development Lifecycle (SSDLC) via secure design, code review, penetration testing, threat modeling, automated security controls, and risk-based vulnerability management. ### Responsibilities - Lead application security assessments, secure code reviews, penetration testing, and threat modeling to identify and mitigate application and API security risks. - Develop and mature application security capabilities across the SSDLC through secure design reviews, automated testing, developer enablement, and scalable security controls. - Partner with software engineering teams to integrate secure coding practices, vulnerability management, and security requirements into development and CI/CD workflows. - Manage and optimize application security tooling, including SAST, SCA, DAST, secrets scanning, repository protections, and related secure development technologies. - Advance secure adoption of cloud-native and AI-enabled solutions through security guidance, architecture reviews, risk assessments, and practical security standards. - Serve as a trusted advisor by communicating risks, remediation priorities, and security best practices. ### Qualifications - Bachelor’s degree in Computer Science, Information Technology, Computer Engineering, Cybersecurity, or a related field, **or** equivalent relevant professional experience. - **5+ years** of experience in application security, product security, DevSecOps, penetration testing, or security engineering. - Demonstrated experience working directly with software engineering teams to integrate security into modern software development processes and delivery pipelines. - Strong expertise in secure coding practices, source code analysis, vulnerability identification, threat modeling, and application security testing. - Hands-on experience implementing and operating application security controls including **SAST, DAST, SCA, secrets scanning**, and CI/CD security integrations. - Deep understanding of web application, API, and cloud-native security principles. ### Preferred Qualifications - Experience securing **Azure** cloud and cloud-native application environments (Azure services, containers, IaC, software supply-chain security, CI/CD security controls). - Hands-on experience securing **AI-enabled applications** (copilots, AI agents, agentic workflows), including risks such as data exposure, trust boundaries, identity & access management, prompt manipulation, and tool invocation. - Experience with **Kubernetes** and cloud-native security technologies (container security, workload protection, admission controls, service meshes, cloud-native security tooling). - Experience automating and scaling security operations via scripting, security tooling, metrics, reporting, and governance in regulated or business-critical environments. - Relevant certifications are preferred, such as: - CSSLP (Certified Secure Software Lifecycle Professional) - GIAC Certified Web Application Defender (GWEB) or Web Application Penetration Tester (GWAPT) - OffSec Certified Professional (OSCP) or OffSec Web Expert (OSWE) - Burp Suite Certified Pr
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.