Sr Application Security Engineer

Nelnet Business Solutions, a division of Nelnet, Inc., provides payment technology and education services. They are seeking a Senior Application Security Engineer to lead application security testing and secure SDLC enablement across various application environments.

Responsibilities:

• Lead manual source code review across priority applications, with emphasis on business logic, access-control, authentication, authorization, and data-protection risks
• Perform and guide application security testing using SAST, DAST, SCA, container scanning, secrets detection, and web/API testing methodologies
• Expand and support the Security Champions program through enablement, coaching, secure coding guidance, and practical developer resources
• Develop and improve automated source code review processes and CI/CD security checks to help scale consistent application security coverage
• Partner with engineering, cloud, and product teams to embed secure SDLC practices into design, development, testing, release, and production support activities
• Create clear vulnerability reports that explain risk, business impact, urgency, and recommended remediation steps for technical and non-technical audiences
• Evaluate and apply AI-assisted tooling to accelerate code review, testing, triage, reporting, and secure development workflows
• Advise teams on threat modeling for web, API, mobile, cloud, and AI-enabled application designs

Requirements:

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, Software Engineering, or a related field; or equivalent combination of education and relevant experience
• 5-7+ years of hands-on application security, software security, or secure software engineering experience
• Experience integrating security tooling and automated checks into CI/CD pipelines
• Familiarity and experience conducting secure code review and testing web/API applications using OWASP Top 10 and web testing methodologies
• Experience effectively assessing, prioritizing, documenting, and communicating vulnerabilities and risk-based remediation guidance to management and engineering audiences
• Experience with technical report writing and communication
• Cybersecurity Proficiencies in required areas
• Coding/Programming Languages
• Automation & Scripting
• Testing & Quality Assurance
• Stakeholder Management & Communication
• Advanced degree or specialized training in application security, cybersecurity, software engineering, cloud security, or related technical discipline
• Experience with AI/LLM-integrated applications, AI security tooling, mobile security, reverse engineering, or advanced application security certifications