Application Security Engineer

Teradata provides an Autonomous Knowledge Platform that unifies data, knowledge, and business context to deliver enterprise intelligence and AI-driven business value. The Application Security Engineer secures applications throughout the software development lifecycle by analyzing vulnerabilities, integrating security tools into CI/CD pipelines, conducting code and cloud security assessments, and guiding development teams on remediation and secure engineering practices.

Responsibilities:

• The Application Security integrates and support security at every phase of the software development lifecycle (SDLC) and work closely with developers to ensure applications are secure from inception through release. Given Teradata’s large portfolio of analytic applications, we are pushing the boundaries of security by automating source code analysis, and analytic security. Our expertise lies in deep technical understanding of security and our application security engineers within Teradata. The Application Security team is tasked with enabling software developers to build secure application and products through automating security (Shifting Left)
• Analyze and triage findings from SAST, SCA, DAST, IaC, and container scanning tools to identify true positives and eliminate noise
• Deliver clear, actionable remediation guidance to development teams for AppSec findings across the application portfolio
• Perform code reviews and reason about vulnerabilities across Java, C/C++, Go, Python, and JavaScript/TypeScript codebases
• Integrate and tune AppSec scanning tools within CI/CD pipelines to shift security left in the SDLC
• Assess web applications and APIs for common vulnerability classes including the OWASP Top Ten (2025)
• Apply OWASP ASVS, AISVS, and SVPS standards to application security assessments and security requirement definitions
• Review AI-assisted development workflows and evaluate agentic systems for risks such as prompt injection, excessive permissions, unsafe tool use, and insecure output handling
• Investigate software supply chain risks by analyzing open-source dependencies for known vulnerabilities, suspicious packages, and dependency confusion exposures
• Write and maintain automation scripts in Go to streamline security processes and tool integrations
• Review and assess Infrastructure as Code configurations in Terraform, CloudFormation, Helm, and Ansible for security misconfigurations
• Evaluate cloud environments across AWS, Azure, and/or Google Cloud for AppSec risk and misconfigurations
• Communicate security findings and risk clearly to both technical and non-technical stakeholders
• Support compliance activities related to PCI-DSS and FedRAMP as they intersect with application security

Requirements:

• Read and reason about code in Java, C/C++, Go, Python, or JavaScript/TypeScript to identify and address security issues
• Integrate SAST, SCA, DAST, IaC, and Container scanning into CI/CD pipelines
• Spot manual security processes and build automation to replace them
• Write and maintain security automation scripts in Go
• Identify and remediate software supply chain risks including malicious or compromised third-party packages, typosquatting, and dependency confusion attacks
• Evaluate internal software and third-party products against security requirements
• Evaluate new technologies and development practices for AppSec impact
• Apply OWASP AI security standards to assess and reduce risk in AI-generated code and agentic workflows outlined in OWASP AI Top Tens
• Familiarity with the OWASP AISVS and OWASP Top 10 for LLMs, Agentic Apps, or NHIs as emerging standards for AI security
• Translate SAST, SCA, DAST, IaC, container scan, and pentest findings into plain-language summaries for non-security audiences
• Work directly with Product Engineering to improve security practices across the Secure SDLC
• Deliver developer training on secure coding, security requirements, and AppSec tooling
• Guide and mentor software engineers on vulnerability remediation
• Serve as the go-to SME for AppSec topics, processes, and tooling
• Make sound, well-reasoned security decisions and explain the tradeoffs clearly
• Knowledge of core application security principles, common security vulnerability classes, their root causes, and mitigations
• MS/BS degree in Electrical Engineering, Computer Science, Information Technology, or related field
• Advanced degree highly preferred