Application Security Engineer

This position supports a U.S. federal government contract. Pursuant to the terms of that contract, this role requires U.S. citizenship.

Company Overview
Our client operates in the application security space and focuses on securing web applications, cloud infrastructure, and third-party integrations. The company is dedicated to reducing vulnerabilities in web platforms and maintaining compliance with industry standards. They are expanding their security team to address growing application security challenges.

Role Summary
The Application Security Engineer will focus on identifying and remediating vulnerabilities in web applications and infrastructure. This role involves working closely with development teams to review code, address security findings from scans and penetration tests, and implement secure coding practices. The engineer will secure WordPress environments, cloud infrastructure, and custom API integrations, supporting the organization’s security posture across multiple platforms.

Key Responsibilities

• Assess and remediate application vulnerabilities across WordPress sites, custom code, and third-party packages.
• Review insecure code, advise on mitigations, and apply necessary patches or adjustments.
• Partner with developers to implement secure coding practices and validate vulnerabilities fixes.
• Maintain PCI DSS compliance for payment pages and address vulnerabilities specific to PCI standards.
• Monitor vulnerability scans, penetration tests, and code reviews; respond with timely remediations.
• Secure cloud environments, including GCP and AWS, by configuring protections against malicious activity and managing security controls.
• Maintain the organization’s Ruby API and assist with related security tasks; Python API experience is desirable.
• Support the security of CI/CD pipelines, infrastructure as code, and security keys.

Key Requirements

• Proven experience securing WordPress websites, including plugin and theme analysis.
• Strong understanding of JavaScript, front-end code, and secure coding practices.
• Experience in remediating security vulnerabilities through penetration testing, scans, and code reviews.
• Familiarity with PHP, JavaScript, and APIs, especially in a web application context.
• Ability to assess and secure cloud infrastructure within GCP and AWS environments.
• Knowledge of PCI DSS standards, particularly version 4.0.1 and associated vulnerabilities.
• Experience working with security tools such as vulnerability scanners and WAFs like Wordfence.
• Ability to collaborate with developers, review security findings, and implement fixes efficiently.

This position requires an experienced application security engineer with a focus on WordPress and front-end secure coding. If you are ready to help reduce security vulnerabilities and strengthen application defenses, apply now to join our client’s growing security team.