Application Security Engineer

Vannevar builds AI systems for consequential Department of War missions and deploys its products directly with operational units. The Application Security Engineer will embed security into the company’s SaaS platform by partnering with software, DevOps, and platform teams to implement security automation, threat modeling, vulnerability detection, incident response, and compliance-focused practices across the software development lifecycle.

Responsibilities:

• Implement and deploy enterprise standard SAST, SCA, secrets-scan, DAST, and container/IaC checks in CI/CD
• Embed with development teams to run threat models, review critical PRs, and coach secure-by-default habits
• Drive a shift-left vulnerability detection program to identify and remediate vulnerabilities earlier in the software development lifecycle (SDLC)
• Coordinate with DevOps for application security issues that cross between application and infrastructure layers
• Support incident-response for product issues and feed lessons back into code, docs, and process

Requirements:

• 5 + years in Application / Product Security
• Hands-on experience securing web applications and automating AppSec workflows
• Familiarity with DevSecOps practices and container security & patching
• Experience with GitHub Actions, Python, TypeScript/JavaScript
• Clear, concise communicator who can translate risk for engineers
• Experience securing LLM workflows
• Experience with NIST Risk Management Framework
• Experience with software security at a U.S. defense contractor
• Active Security Clearance (or ability to obtain one)