Senior Application Security Engineer

Brooksource is seeking an experienced Application Security Engineer to embed Secure-by-Design and Privacy-by-Design principles directly into the software development lifecycle. This role focuses on building scalable, developer-native security guardrails that proactively prevent insecure or non-compliant code from being introduced into production.

Responsibilities:

• Design, implement, and maintain automated security controls within CI/CD pipelines using GitHub Actions
• Develop deterministic policy-as-code gates for SAST, SCA, API validation, and schema enforcement
• Ensure insecure code cannot be merged through fully automated, non-discretionary controls
• Implement source-level detection for sensitive data (PHI, PII, secrets) using regex and machine learning classifiers
• Build CI/CD controls that prevent sensitive data from entering source control, logs, or build artifacts
• Continuously improve detection accuracy and reduce false positives
• Define and enforce Layer 7 security standards, including TLS 1.3, HSTS, OAuth/OIDC, and JWT lifecycle policies
• Automate OpenAPI specification linting to prevent overexposure of endpoints and data leakage
• Standardize authentication and authorization patterns across all services
• Build and maintain reusable libraries for encryption, tokenization, and data redaction
• Ensure secure data handling practices are adopted by default across all product teams
• Partner with engineering teams to integrate privacy-preserving patterns seamlessly
• Generate Software Bill of Materials (SBOM) for every build
• Implement artifact signing and attestation processes
• Enforce provenance verification at deployment through automated pipeline policies

Requirements:

• 5+ years of experience in Application Security or Software Engineering with a focus on data security
• Hands-on experience with GitHub Actions and CI/CD security automation
• Strong knowledge of secret detection, DLP tools, and API security best practices
• Experience implementing OAuth/OIDC-based authentication systems
• Proficiency in at least one programming language such as Python, Go, or TypeScript
• Strong understanding of secure development practices and developer workflows
• Experience with policy-as-code frameworks (e.g., OPA, Rego)
• Familiarity with cloud-native security architectures (AWS, Azure, or GCP)
• Experience building internal developer platforms or security tooling
• Knowledge of compliance frameworks (HIPAA, GDPR, SOC 2)