Lead Application Security Engineer – DevSecOps

Job Description: • Socialize and drive execution of key security best practices across the R&D organization • Contribute to the enterprise security catalog of best practices, techniques, and patterns • Improve the quality and adoption of Security Development Lifecycle practices • Own the evaluation, design, implementation, integration, reliability, and continuous improvement of application security capabilities • Support SAST, SCA, DAST, API security testing, and vulnerability management workflows • Document, share, and help automate coverage for common abuse cases and attacks • Lead the API security testing program • Manage API discovery, authenticated and unauthenticated testing, scanner attribution, onboarding, exclusions, ownership mapping, findings routing, and operational readiness • Identify and explain feature-level design or architectural weaknesses that could create security issues • Partner with enterprise security leadership to track and prioritize open issues and follow through on resolution • Work with DevOps, Infrastructure, IAM, API Gateway, NOC, Enterprise Security, and application teams to design and operate security-hardened platforms • Set technical strategy, influence stakeholders, and define measurable security outcomes Requirements: • Bachelor’s degree in Computer Science, Computer Engineering, Cyber Security, or similar, or equivalent experience • At least 3 years of experience as a software developer • 3–5 years in a security-focused development role in an agile environment • Experience in software and product design and architecture, product security, and security issue prevention and mitigation • Strong software engineering background • Ability to develop, review, and troubleshoot code in one or more languages • Practical experience with Docker and Terraform • Strong knowledge of OAuth 2.0, OpenID Connect, JWT, SAML, and service-to-service authentication • Solid understanding of RESTful services, service bus architectures, JSON, and related web services concepts • Experience with SAST, SCA, DAST, API security testing, vulnerability aggregation, and CI/CD security controls • Hands-on experience with cloud platforms, containers, infrastructure as code, secrets management, and CI/CD • Knowledge of HIPAA, HITRUST, and PCI-DSS is a plus Benefits: • Health and financial benefits • Commuter support • Employee assistance programs • Tuition assistance • Employee resource groups • Collaborative workspaces • Flexible work arrangements and work-life balance support • Company events including book clubs, external speakers, and hackathons • Learning-focused company culture • Engaged team support • Inclusive environment • Annual discretionary bonus plan, variable compensation plan, and equity plans (depending on role eligibility)