Note: The job is a remote job and is open to candidates in USA. World Wide Technology is a technology solutions company that provides cybersecurity, cloud, infrastructure, and digital services. The Senior Application Security Engineer will secure WWT-developed and WWT-operated applications by managing vulnerabilities, operating security tooling, conducting secure code reviews and threat modeling, and integrating security into the SDLC. The role also includes penetration testing, AI/LLM application security, compliance support, and mentoring engineering teams.
Responsibilities
- Own the technical core of the application vulnerability lifecycle, driving discovery and detection, validating exploitability, prioritizing by risk, offering technical remediation guidance, and verifying fixes fully close the issue
- Cut through scanner noise by dismissing false positives with rationale and documenting clear, actionable remediation developers can act on
- Maintain playbooks that make triage, escalation, and remediation repeatable as we scale
- Operate and maintain application security tooling (SCA, SAST, DAST, secrets, etc.) across the SDLC
- Drive adoption of security tooling, partnering with developers to integrate into their workflows and maximize meaningful coverage
- Partner with DevOps to build security into delivery by integrating SCA, SAST, and DAST into the CI/CD pipeline
- Perform secure code reviews, threat models (STRIDE/PASTA), and design and architecture reviews for net-new and high-risk applications
- Surface validated findings where developers already work – IDE, pull request, ticketing – to minimize noise and context switching
- Contribute to documentation that gives developers a clear path to shipping secure code
- Scope, execute, and coordinate penetration tests across the organization’s environment overseeing remediation and validation retests
- Perform hands-on manual testing to uncover business-logic flaws, chained exploits, and vulnerabilities that automated scanners miss
- Apply secure development practices to AI/LLM-enabled and agentic applications; assess risks like prompt injection, tool poisoning, confused-deputy, and credential exposure
- Make responsible, hands-on use of AI to work faster and more effectively, reflecting our culture as an AI-first company operating at the leading edge of the field
- Act as a credible application security escalation point for engineering and a force multiplier – an enabler, not a gatekeeper
- Produce technical evidence and control mappings that satisfy compliance and audit needs across CMMC, SOC 2, ISO 27001, and NIST 800-171/800-53
Skills
- Bachelor's degree in Computer Science, Software Engineering, Information Security, or a related field — or equivalent hands-on experience
- Minimum 8 years of experience in roles related to application security, information security, software engineering, SecDevOps
- A demonstrable track record of independently owning AppSec domains and delivering remediation without close supervision
- Hands-on experience operating application security scanning tooling (SAST, SCA, secrets, IaC) and integrating it into CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins, Azure DevOps, or equivalent)
- Experience securing cloud-native and container/Kubernetes-based applications (AWS, Azure, GCP; Docker, Kubernetes, OpenShift)
- Ability to read and reason about code in one or more modern stacks (Java, JavaScript/TypeScript, Python, Go, or C#) well enough to perform and review secure code, trace data flows, and identify vulnerabilities in source code
- Scripting and automation in Python, Bash, or PowerShell
- Design-level understanding of authentication, authorization, and identity — session management, SSO and federation, and OAuth2/OIDC as architectural patterns
- Working knowledge of applied cryptography — TLS, certificates and PKI, secrets and key management, hashing versus encryption
- Strong command of HTTP and web API internals — request/response semantics, auth flows (OAuth2/OIDC, JWT, session management), and the authZ failures, injection, and business-logic flaws common to REST and GraphQL APIs
- Solid understanding of the secure software development lifecycle and where security testing, gates, and controls fit within it
- Strong working knowledge of OWASP ASVS, OWASP Top 10, OWASP API Security Top 10, MITRE ATT&CK, and CWE
- Working knowledge of NIST SSDF (SP 800-218), NIST 800-53, NIST 800-171, ISO 27001, SOC 2, and CMMC as they apply to secure software development
- Hands-on threat modeling experience (STRIDE, PASTA, or equivalent)
- Excellent interpersonal, written, and verbal communication — able to explain and document security risk and remediation credibly to both engineers and non-technical stakeholders
- Self-starter, team player, and enthusiasm for learning
- Applicants must be authorized to work in the United States without sponsorship. We are unable to provide sponsorship now or in the future for this position
- Direct, hands-on experience with one or more leading application security platforms (e.g., Wiz, Snyk, Apiiro, OX Security, Cycode, Checkmarx, Veracode, or GitHub Advanced Security)
- Hands-on experience securing AI/LLM-enabled and agentic applications; familiarity with OWASP Top 10 for LLM Applications, OWASP Top 10 for Agentic AI, MITRE ATLAS, NIST AI RMF, and Model Context Protocol (MCP) security implications
- Hands-on penetration testing or offensive security experience across web, API, infrastructure, or AI systems (including prompt injection, jailbreaks, and agent abuse)
- Industry certifications such as CISSP, CSSLP, GWAPT, GWEB, OSCP, OSWE, or AWS/Azure/GCP security certifications
Benefits
- Health (Medical & Prescription), Dental, and Vision Care
- Onsite Health Centers (MO & IL)
- Employee Assistance Program
- Wellness program
- Profit Sharing
- 401k Plan with Company Matching
- Life and Disability Insurance
- Flexible Spending Accounts
- Tuition Reimbursement
- PTO & Holidays
- Parental Leave
- Medical Leave
- Military Leave
- Bereavement
- Day of Caring
- Family Planning Benefits
- Nursing Mothers Benefits
- Voluntary Legal
- Voluntary Supplemental Accident/Illness/Hospital
- Voluntary ID Theft
- Pet Insurance
- Employee Discount Program
Company Overview