Clear CapitalRemote

Senior Application Security Engineer

United States of America

Full Time

2 weeks ago

$111,000 - $144,000 USD

Visa Sponsor

Key skills

Application Security TestingStatic Application Security Testing (SAST)Dynamic Application Security Testing (DAST)Software Composition Analysis (SCA)Threat ModelingVulnerability and Penetration TestingAPI SecurityOWASP Top Ten MitigationAWS SecurityPrivate Cloud SecurityProgramming and Scripting JavaProgramming and Scripting PythonProgramming and Scripting C++Programming and Scripting RubyProgramming and Scripting JavaScriptProgramming and Scripting PowerShellProgramming and Scripting PHPSecurity and Compliance Frameworks ISO 27001Security and Compliance Frameworks NISTSecurity and Compliance Frameworks GDPRSecurity and Compliance Frameworks CISSecurity and Compliance Frameworks SOC 2JavaScriptPythonJavaC++CPHPRubyPowerShellAILLMAWSCommunicationOWASPPenetration Testing

About this role

Clear Capital is seeking a Senior Application Security Engineer to strengthen the security of its applications, services, and connected dependencies. The role focuses on application security testing, vulnerability remediation, AI security initiatives, secure development practices, stakeholder communication, and developer training.

Responsibilities:

Plan and carry out application security testing in all phases of the software development life cycle to identify vulnerabilities in applications and weaknesses in secure coding practices
Assess discovered vulnerabilities and recommend risk-mitigating solutions, leveraging automation to improve the efficiency of both testing and remediation processes
Communicate findings, risks, and recommendations to stakeholders, while documenting delivery and implementation progress against defined service-level agreements (SLAs) and business metrics
Lead AI security initiatives, including threat modeling production LLM stacks for autonomy and prompt injection risks, and auditing third-party models and APIs to secure the software supply chain
Attend and participate in product and application projects. This includes interacting with business units and technical teams to understand what is coming and how their projects can be more secure from the beginning
Collaborate with architects and development teams to drive secure design practices, leveraging established security standards, configurations, and frameworks
Fully define and follow a security review process to ensure an automated and repeatable process is managed
Regularly monitor the security community for public-facing security issues, as well as to learn new tactics that can be used in testing
Train developers and junior application security engineers on weaknesses to avoid
Perform other duties as assigned

Requirements:

4+ years of related experience required
Bachelor's Degree, ideally in a technically related field (Computer Science, Information Technology, Software Engineering), or equivalent work experience
Highly technical and analytical, with a background in software development, and scripting (e.g., Java, Python, C++, Ruby, JavaScript, PowerShell, PHP)
Expertise in application security testing, including hands-on experience with Static (SAST), Dynamic (DAST), and Software Composition Analysis (SCA) tools
Proficiency in application security assessments, including threat modeling, vulnerability and penetration testing, API security, OWASP Top Ten mitigation, and securing applications in AWS and private cloud environments
Relevant certifications such as C|ASE, CSSLP, GWAPT, OSCP, or equivalent
Experience with frameworks such as ISO 27001, NIST, GDPR, CIS, or SOC 2