Senior Engineer - Application Security
Bristol Myers SquibbResponsibilities
- Lead implementation and continuous improvement of SAST, SCA, and DAST across the application portfolio.
- Govern application security scope and coverage processes.
- Plan and perform manual penetration testing of web applications and APIs, validate findings, explain business impact, and support remediation and retesting.
- Embed automated security checks and quality gates into CI/CD pipelines and developer workflows.
- Drive adoption and quality improvement of AI-assisted code scanning.
- Partner with development and architecture teams on secure design, threat modeling, and complex vulnerability remediation.
- Develop security automation in Python, Java, or similar languages and integrate security tools through REST APIs.
- Mentor junior team members and serve as an escalation point for complex application security issues.
- Track security risks, remediation progress, and key metrics while communicating priorities to technical and business stakeholders.
- Use CNAPP tools such as Wiz.io to assess and mitigate code and cloud vulnerabilities across AWS, Azure, and GCP environments.
Requirements
- At least 5 years of hands-on application security experience, including SAST, SCA, and DAST.
- Strong experience performing manual penetration testing of web applications and APIs.
- Strong understanding of secure SDLC, OWASP Top 10, CWE, DevSecOps, and vulnerability management.
- Coding or scripting ability in Python, Java, or a similar language, including developing proof-of-concept exploits and automated multi-stage attack-chain tools.
- Experience integrating security testing into CI/CD pipelines and developer workflows.
- Experience with cloud security services and mitigating code and cloud vulnerabilities in AWS, Azure, and GCP multi-cloud environments.
- Strong communication skills and ability to lead cross-functional security initiatives.
- Preferred: experience with AI-assisted code scanning or security testing of AI/LLM-enabled applications.
- Preferred: OSCP, GWAPT, CSSLP, CISSP, or equivalent certification.
- Preferred: experience supporting an enterprise-scale application security program.
Benefits
- Bristol Myers Squibb offers growth opportunities, a supportive and inclusive environment, wellbeing support, and comprehensive benefits.
- Work models include site-essential, site-by-design, field-based, and remote-by-design, with the assigned model based on the role's core responsibilities.
- Reasonable workplace accommodations and ongoing support are available for applicants and employees with disabilities.
About Bristol Myers Squibb
At Bristol Myers Squibb, we work every day to transform patients’ lives through science. That work inspires some of the most interesting, meaningful, and life-changing careers you’ll experience. Join us and pursue innovative ideas alongside some of the brightest minds in biopharma, collaborating with a team rich in diversity of experiences, and perspectives. We have built a sustainable pipeline of potential therapies and are leveraging translational medicine and data analytics to understand how we can deliver the right medicine to the right patient, at the right time, to achieve the best outcome. Whether in a scientific, business or supporting function, a career at BMS means you’ll be inspired every day to grow and thrive through opportunities that are uncommon in scale and scope. Here, you’ll be on the cutting edge of powerful innovation in oncology, hematology, immunology, cardiovascular disease, and fibrosis, with colleagues united in the mission to help patients. Through the Bristol Myers Squibb Foundation, we also promote health equity and seek to improve health outcomes of populations disproportionately affected by serious diseases and conditions. Our mission is to give new hope to help patients prevail over serious disease – it drives everything we do. Review our Social Media Community Guidelines at: https://www.bms.com/social-media-community-guidelines.html