Note: The job is a remote job and is open to candidates in USA. Nelnet Business Solutions, a division of Nelnet, provides payment technology and education services to educational institutions, schools, students, families, and supporters. The Senior Application Security Engineer will lead hands-on application security testing, secure code review, threat modeling, and secure SDLC enablement while partnering with engineering, cloud, and product teams to reduce security risks and scale application security practices.
Responsibilities
- Lead manual source code review across priority applications, with emphasis on business logic, access-control, authentication, authorization, and data-protection risks
- Perform and guide application security testing using SAST, DAST, SCA, container scanning, secrets detection, and web/API testing methodologies
- Expand and support the Security Champions program through enablement, coaching, secure coding guidance, and practical developer resources
- Develop and improve automated source code review processes and CI/CD security checks to help scale consistent application security coverage
- Partner with engineering, cloud, and product teams to embed secure SDLC practices into design, development, testing, release, and production support activities
- Create clear vulnerability reports that explain risk, business impact, urgency, and recommended remediation steps for technical and non-technical audiences
- Evaluate and apply AI-assisted tooling to accelerate code review, testing, triage, reporting, and secure development workflows
- Advise teams on threat modeling for web, API, mobile, cloud, and AI-enabled application designs
Skills
- * Bachelor's degree in Computer Science, Cybersecurity, Information Technology, Software Engineering, or a related field; or equivalent combination of education and relevant experience
- * 5-7+ years of hands-on application security, software security, or secure software engineering experience
- * Experience integrating security tooling and automated checks into CI/CD pipelines
- * Familiarity and experience conducting secure code review and testing web/API applications using OWASP Top 10 and web testing methodologies
- * Experience effectively assessing, prioritizing, documenting, and communicating vulnerabilities and risk-based remediation guidance to management and engineering audiences
- * Experience with technical report writing and communication
- To be considered, candidates must already be authorized to work in the United States without the need for current or future sponsorship
- * Advanced degree or specialized training in application security, cybersecurity, software engineering, cloud security, or related technical discipline
- * Experience with AI/LLM-integrated applications, AI security tooling, mobile security, reverse engineering, or advanced application security certifications
Benefits
- Medical insurance
- Dental insurance
- Vision insurance
- Health Savings Account (HSA)
- Flexible Spending Account (FSA)
- Generous earned time off
- 401(k)
- Student loan repayment
- Life insurance
- AD&D insurance
- Employee assistance program
- Employee stock purchase program
- Tuition reimbursement
- Performance-based incentive pay
- Short-term disability
- Long-term disability
- Robust wellness program
- Hybrid work option for associates living within 30 miles of an office location, allowing remote work for part of the week while working in-office three days per week
Company Overview