Senior Application Security Engineer

BlueModus is hiring a Senior Application Security Engineer to secure its application code and Azure infrastructure. The role owns security tooling and vulnerability remediation, contributes security architecture input to client engagements, and partners with engineering and infrastructure teams.

Responsibilities:

• Hold a standing seat in code review for anything touching authentication, encryption, or client data, and investigate and remediate end to end whenever that review or our tooling surfaces a real vulnerability
• Build and own our security signal layer: Defender for Cloud, Sentinel and Log Analytics (KQL), GitHub Advanced Security or equivalent, and SAST, SCA, secrets, and IaC scanning wired into CI/CD as real gates, not reports nobody reads
• Triage what that tooling produces. Cut the noise, tune the rules, and track metrics that actually mean something, including vulnerability MTTR, secrets exposure, dependency age, and coverage across repos, and keep those metrics visible to delivery leads rather than buried in a dashboard only you check
• Turn findings into process: secure-by-default project templates, pipeline policies, AI code-review rules, and coding standards that are enforced, not just published
• Run structured security reviews across our existing codebase and client engagements, looking for the same class of vulnerability anywhere else it might be hiding
• Provide security architecture input on new client engagements and proposals, so security is part of the conversation before a contract is ever signed
• Mentor developers on secure coding practices, building real security instinct across the team rather than catching everything yourself in review
• Stay current on emerging vulnerabilities and attack techniques, and translate what actually matters into concrete changes to how we build
• Help the Infrastructure team set up, harden, and patch client and internal environments, and work directly with clients on their Azure tenants
• Pitch in on Help Desk support when Infrastructure needs an extra hand

Requirements:

• 7+ years of experience in application security, security engineering, or a hybrid development and security role
• Strong, hands-on experience with Microsoft Azure, including identity and access management, Key Vault, Defender for Cloud, and Sentinel/Log Analytics (KQL)
• Real fluency reading and writing code, ideally C# and .NET, enough to review a pull request and spot the problem yourself rather than waiting on a scanner
• Experience with CI/CD security tooling such as static analysis (Semgrep, CodeQL, or GitHub Advanced Security), dependency scanning (Snyk, Dependabot), or infrastructure-as-code scanning (Checkov, tfsec)
• Experience running a vulnerability or security program with real metrics behind it, not just ad hoc scanning when something feels off
• Comfort contributing security input in a pre-sales or proposal setting, translating technical risk into plain language for clients and account teams
• Comfort working directly inside a Development team's day-to-day workflow, not from behind a separate security function
• Clear, confident communication, since you'll explain the same vulnerability to a developer and to a client with equal credibility
• A genuine doer mentality: comfortable diving into unfamiliar code or infrastructure and finding the real problem instead of just flagging a policy gap
• Comfortable flexing into general System Administration and Help Desk support alongside your security work, not just the specialized pieces
• OSCP, AZ-500, or equivalent hands-on credentials are a strong plus; we weigh demonstrated skill well above certifications collected for their own sake
• If you've held roles like Application Security Engineer, DevSecOps Engineer, Security Engineer, Penetration Tester, or Senior Developer with a strong security focus, and you'd rather find and fix the vulnerability yourself than just write it up for someone else to handle, this role is a strong fit