Arcadia Group LtdRemote
Application Security Engineer
United States of America
Full Time
1 hour ago
$131,000 - $235,000 USD
No H1B
Key skills
Application SecuritySAST toolingDAST toolingSCA toolingCSPM toolingSnykCheckmarxSemgrepWizCI/CD pipelinesGitHub ActionsJenkinsGitLab CIPipeline integrationsContainer securityDockerKubernetesAPI securityRESTGraphQLAWS GuardDutyAWS Security HubAWS IAM Access AnalyzerThreat modelingSTRIDEPASTAOSCPGWAPTCSSLPAIAWSIAMGitHubGitLabSaaSSDLCCI/CDLeadership
About this role
Arcadia Group Ltd is an AI-powered energy intelligence platform that helps businesses manage their energy needs efficiently. They are seeking a technically hands-on Application Security Engineer to own the vulnerability management lifecycle, integrate security automation into the CI/CD pipeline, and provide security expertise to the engineering organization.
Responsibilities:
- Own the end-to-end vulnerability management lifecycle: triage, prioritize, and drive remediation of findings from SAST, DAST, and SCA tooling in partnership with engineering squads
- Maintain, optimize, and extend security tooling integrations within the CI/CD pipeline with the goal of automating everything that can be automated
- Launch and run a Security Champions program, including workshops and office hours, to embed security knowledge directly into development teams across multiple geographies
- Act as the application-layer subject matter expert during security incidents, supporting triage, root cause analysis, and remediation
- Partner with Product and Engineering leadership to introduce security touchpoints earlier in the SDLC, including threat modeling and design review processes
Requirements:
- 3–5 years of dedicated Application Security experience in a SaaS or cloud-native environment
- Hands-on proficiency with at least two of the following: SAST, DAST, SCA, or CSPM tooling (e.g., Snyk, Checkmarx, Semgrep, Wiz)
- Strong working knowledge of CI/CD pipelines (e.g., GitHub Actions, Jenkins, GitLab CI) and the ability to write and maintain pipeline integrations
- Experience with container security (Docker, Kubernetes) and API security patterns (REST, GraphQL)
- Demonstrated ability to communicate technical risk to non-security engineers in a way that drives action, not anxiety
- Experience standing up or maturing a Security Champions program
- Familiarity with cloud-native AWS security services (GuardDuty, Security Hub, IAM Access Analyzer)
- Exposure to threat modeling frameworks (STRIDE, PASTA, or lightweight equivalents)
- Relevant certifications (OSCP, GWAPT, CSSLP) — valued but not required