Software Security Engineer

Celink is a reverse mortgage servicer operating in a regulated financial services environment with proprietary servicing platforms and internal applications. The Software Security Engineer will secure internally developed applications, APIs, and software delivery processes by embedding secure-by-design practices, managing application security tooling, supporting remediation, and reporting on security risks and trends.

Responsibilities:

• Partner with software engineering, architecture, and DevOps teams to embed security requirements and secure-by-design practices into the software development lifecycle
• Perform threat modeling, secure design reviews, and application architecture assessments for internally developed applications, APIs, and supporting services
• Review results from SAST, DAST, SCA, secrets scanning, and related AppSec tools, and help teams prioritize and remediate findings based on risk and business context
• Help define, document, and improve secure coding standards, development guardrails, and security patterns for internal engineering teams
• Provide guidance and hands-on support to development teams on secure coding practices, common vulnerability patterns, and effective remediation approaches
• Partner with teams to improve application security controls such as authentication, authorization, secrets handling, logging, and secure configuration
• Support and conduct security testing activities for web, API, and cloud-based applications, and validate remediation of identified vulnerabilities
• Configure, maintain, and optimize application security tools and integrations used in CI/CD and developer workflows to improve efficiency, consistency, and coverage of application security processes
• Develop and deliver practical security training and guidance for developers and other stakeholders involved in software delivery
• Support internal audits, risk assessments, and compliance activities related to application security controls and software development practices
• Research emerging application security risks, tools, and techniques, and recommend practical improvements aligned to Celink’s environment
• Performs other duties and projects as assigned

Requirements:

• Bachelor's degree (or equivalent experience) in computer science, information security, software engineering, or a related field
• 5+ years of experience in application security, secure software engineering, or a closely related field, with emphasis on enterprise and distributed application environments
• 5+ years of hands-on experience working with software development teams on secure SDLC practices, code review, vulnerability remediation, and security testing; prior software development experience is strongly preferred
• Strong understanding of modern web, API, and distributed application architectures, and the ability to assess security implications across those environments
• Knowledge of common web, API, and cloud application vulnerabilities and effective remediation approaches, as well as of application security testing tools and methods
• Deep understanding of secure software development principles, including OWASP Top 10 for web and API security, code and dependency analysis, and practical remediation techniques
• Detailed technical knowledge of authentication, authorization, cryptography fundamentals, common application vulnerabilities, and effective remediation strategies
• Practical familiarity with modern application development stacks and frameworks such as React, Angular, Node.js, Java, Javascript
• Ability to influence technical teams, drive remediation, and balance sound risk management with practical delivery needs
• Experience with AWS-hosted applications, CI/CD security integration, and automation of application security workflows
• Ability to articulate, plan, implement, and continuously improve application security practices in partnership with development and technology teams
• Demonstrated strong critical thinking, problem-solving, and analytical ability, including the judgment to prioritize issues based on technical and business risk
• Strong verbal and written communication skills, with the ability to clearly explain security findings and recommendations to developers, architects, and leadership audiences
• some travel may be required
• There may be some travel with overnight stays
• Industry certifications such as CSSLP, CISSP or other relevant application security or cloud security credentials are preferred