Senior Application Security Engineer (Remote - US only)

Candidates must be legally authorized to work in the United States; no visa sponsorship is offered. Some travel (up to 10%) may be required. A privately held information security services firm with a strong focus on advisory and hands-on security work for large enterprises and public sector clients is hiring a Senior Application Security Engineer for its Southeast Application Security practice. The practice assesses applications, embeds security into engineering pipelines, and advises development and security leaders. The role blends hands-on testing, DevSecOps automation, and client-facing advisory work, including reviewing AI-enabled and agentic applications.

What you'll do

• Operate and tune SAST, DAST, SCA, secrets, and infrastructure-as-code scanning tools for clients, triaging findings and giving prioritized remediation guidance
• Design and maintain security tool integrations in CI/CD pipelines, source control, IDEs, and ticketing systems, including policy gates
• Coach development teams on secure coding and remediation to build security into the software development lifecycle
• Review software supply chain controls such as SBOM generation, dependency and container scanning, artifact signing, and pipeline security
• Carry out threat modeling and architecture reviews for cloud-native, container, and infrastructure-as-code environments
• Help clients mature AppSec programs by defining metrics, vulnerability management SLAs, and roadmaps aligned to OWASP SAMM, BSIMM, or NIST SSDF

What you need

• 4 to 8+ years of experience in application security, web penetration testing, DevSecOps, or security-focused software development
• Hands-on proficiency with Burp Suite Pro and a solid grasp of the OWASP Top 10 and OWASP API Security Top 10
• Experience with secure SDLC practices and guiding teams through remediation of findings from AppSec tools
• Ability to review source code in one or more languages such as JavaScript/TypeScript, Python, Java, C#, Go, PHP, or C/C++
• Working knowledge of AWS, Azure, or GCP, containers, and Git-based workflows
• Clear written and verbal communication for both technical and executive audiences

Applicants must be based in: United States.

How to apply

Get the free i'llTip app to see the employer's details and apply. i'llTip's AI can tailor your résumé to this job, and you'll get alerts for similar roles.

Prefer the website? Continue on illtip.comOr get the app: Android · iPhone

🔔 Get new jobs like this first: join i'llTip Jobs on Telegram · or get personal job alerts