Application Security Engineer

Zocdoc is a digital health marketplace that helps patients find and book in-person or virtual care. The Application Security Engineer will help engineering teams build secure software by supporting the secure software development lifecycle, application security governance, compliance activities, and AI security guardrails.

Responsibilities:

• Serving as an accessible point of contact for engineering squads, helping teams understand and follow secure development lifecycle guidelines
• Assisting developers in reviewing and interpreting alerts from static analysis and software composition analysis tools, including helping distinguish true vulnerabilities from false positives
• Providing clear, actionable guidance on remediating common application security vulnerabilities, including issues aligned to the OWASP Top 10
• Helping maintain internal security documentation, developer playbooks, and secure coding training materials so that compliance expectations are clear and achievable
• Supporting application security governance by tracking key security milestones and organizing technical evidence from repositories and deployment pipelines for compliance audits
• Monitoring application security metrics, including vulnerability patch timelines and policy exceptions, to support regular leadership reporting
• Working with cutting-edge GenAI tools and technology while supporting AI governance frameworks and helping ensure AI-enabled workflows align with privacy and security guardrails

Requirements:

• Personally motivated by helping teams build secure software and reduce risk before issues reach production
• Autonomous, urgent, and creative. You genuinely love turning security requirements into practical guidance for developers
• Highly collaborative and energized by partnering with engineering squads across the software development lifecycle
• Passionate about application security, secure coding, and improving how teams work within modern development environments
• A clear communicator who can make security concepts approachable and actionable for technical partners
• The kind of person who is excited by emerging technology trends, especially AI security risks and automated workflows
• Serious about your work, but not about yourself
• Meaningful experience in an information security role, software engineering position, or IT audit function with an application security focus
• A foundational understanding of software development processes and how security fits into agile environments
• Familiarity with code review concepts and comfort reading at least one major language used in cloud environments, such as Python, JavaScript, Go, or Java
• Basic exposure to cloud environments such as AWS, GCP, or Azure, along with an understanding of Git workflows
• A conceptual understanding of vulnerability categories and web application security standards
• An interest in emerging technology trends, especially AI security risks and automated workflows
• Required: the ability to integrate generative AI tools into daily workflows to automate tasks, foster innovation, and maximize productivity
• Superb communication skills, humility, and a collaborative approach to supporting stakeholders across engineering and security
• equivalent hands-on experience
• certifications such as Security+, GSEC, or CEH are also highly valued
• A degree in Computer Science, Cybersecurity, or a related technical field is preferred