Sr Application Security Engineer - Cyber Security

RED SKY Consulting is recruiting for a client whose identity is not specified. The Senior Application Security Engineer designs, implements, and supports application security capabilities across software development lifecycles, partnering with development, platform engineering, and cybersecurity teams to assess risk and enable secure software delivery.

Responsibilities:

• Develop, implement, and support application security programs across Software Development Lifecycles (SDLCs), including technology integration, workflow design, documentation, training, and stakeholder enablement
• Evaluate SDLCs and advise on application security technologies, integration points, AI-assisted threat modeling, risk analysis, and process improvements to reduce software security risk
• Perform code, vulnerability, and configuration analysis using manual review, automated application security testing solutions, agentic-code review capabilities, and AI-enhanced pipeline security controls, including SAST and DAST tools
• Partner with development teams to prioritize product vulnerabilities, validate mitigation urgency, and provide remediation guidance and recommendations
• Integrate AI-enhanced security automation into CI/CD pipelines, including agentic-code analysis, AI-assisted threat modeling, automated triage, risk-based release gating, and feedback loops that improve developer remediation workflows
• Configure, implement, maintain, troubleshoot, and support capacity planning for cyber security tools, devices, infrastructure, and application security technologies
• Monitor tool health, respond to security outputs, and tune solutions to support reliable performance, business-focused monitoring, and program objectives
• Respond to cyber security events and incidents with professionalism and support practice exercises for use case driven alerts and incidents
• Identify security requirements and support cyber security architecture, secure configuration, and product security reviews across heterogeneous computing environments
• Create and maintain cyber security documentation, including design materials, standard operating procedures, protocols, diagrams, metrics, reports, and presentations
• Collaborate with cyber security, IT, business, development, quality assurance, and administrative teams to troubleshoot issues, support operational needs, and promote secure software development practices
• Manage operational requests by submitting and responding to tickets, preparing change management items, and participating in Change Approval Board (CAB) meetings
• Stay current on malware, infiltration and investigative techniques, forensics, application security practices, and the evolving threat environment
• Mentor junior engineers to develop job competency, technical skills, and cyber security expertise
• Perform job duties in a safe manner
• Attend work as scheduled on a consistent and regular basis
• Perform other related duties as assigned

Requirements:

• Strong ownership of AppSec tooling and integrations across development pipelines; ability to design, re-architect, and replace tools as needed
• Deep technical capability to analyze vulnerabilities in code, pinpoint issues, and articulate developer-friendly remediation guidance; empathetic risk communication with dev teams
• Hands-on experience with SAST and SCA
• CI/CD and DevOps pipeline experience: GitHub, GitHub Actions, Argo CD; scripting in GitHub Actions and Python
• Cross-functional understanding of cloud hosting and runtime environments, connecting end-to-end web application architecture and risk-based judgment/documentation; mentorship of junior engineers
• At least 21 years of age
• Proof of authorization to work in the United States
• Bachelor's degree in Computer Science or related field
• Must be able to obtain and maintain any certification or license, as required by law or policy
• 5 - 7 years of experience in cyber security or information technology
• Experience in at least 5 of the following: Secure SDLC, DevSecOps, or application security program support
• Implementing application security testing tools, including SAST, DAST, SCA, secrets scanning, or container scanning
• CI/CD pipeline security, release gating, and developer workflow integration
• Agentic-code security, AI-assisted secure code review, automated vulnerability triage, and AI-enhanced pipeline risk scoring
• Cloud architecture security, including secure configuration, identity, network, and workload protection
• Application vulnerability assessment, triage, and remediation validation
• Software composition analysis, open-source risk management, and dependency vulnerability management
• API security testing, web application security testing, and secure coding practices
• Container, Kubernetes, and cloud workload security
• Cloud security posture management and application security configuration scanning
• Threat modeling, AI-assisted threat modeling, and risk analysis for applications, APIs, cloud services, and emerging technologies
• Secrets management, credential exposure detection, and secure key management practices
• Application and cloud security logging, detection, alerting, and use case development
• Application security incident response, vulnerability disclosure, and product security response processes
• Infrastructure as Code security, policy-as-code, and secure configuration management
• Application, cloud, and software supply chain threat intelligence
• Application security metrics, risk reporting, and program maturity measurement
• Problem solving skills and the ability to work under pressure in a constantly changing environment
• Ability to manage deadlines and changing priorities
• Must be self-motivated and a team player collaborating with a team that spans the globe
• Demonstrates responsibility and accountability
• Must be able to communicate effectively with team members, management, senior management and consultants both verbally and in writing
• Must be able to create and document network and system diagrams
• Must be able to write understandable procedures
• Must be able to design, install and implement cyber infrastructure solutions that integrate with the existing infrastructure
• Ability to demonstrate a calm demeanor when faced with chaotic circumstances
• Knowledge of networking concepts and principles
• Strong interpersonal skills with the ability to communicate effectively with guests and other Team Members of different backgrounds and levels of experience
• practical DAST experience with StackHawk is a strong plus