Senior Application Security Engineer
Accelerant2 days ago
Remote, United StatesSenior
Responsibilities
- Own and improve application security practices across web applications, APIs, services, and CI/CD pipelines.
- Manage the external penetration testing program, including planning, scoping, scheduling, vendor engagement, findings review, remediation tracking, and retesting.
- Partner with development squads and third-party penetration testing providers to prioritize and close Critical and High vulnerabilities and other significant findings.
- Build proactive vulnerability remediation processes using approved security AI agents and automation.
- Operate and improve SAST, DAST, SCA, container, secrets, and vulnerability-scanning capabilities within development workflows.
- Maintain WAF policies, application perimeter protections, API security policies, filtering, and rate-limiting controls.
- Support threat modeling, secure design reviews, vulnerability assessments, incident response, and secure coding practices.
- Gather and maintain evidence supporting ISO 27001, SOX, and SOC 1/2 requirements.
- Provide security guidance, documentation, reporting, and education to technical teams.
Requirements
- At least 5 years of experience in application security, product security, DevSecOps, or a related discipline.
- Strong understanding of web application and API security, authentication, authorization, sessions, common attack patterns, and the OWASP Top 10.
- Experience managing external penetration testing or similar third-party security assessment programs.
- Experience with vulnerability management and security-scanning tools such as Snyk, Qualys, Trivy, Dependabot, GitHub Advanced Security, or equivalent platforms.
- Experience integrating security controls into CI/CD pipelines and development workflows.
- Experience with WAF policy management, API security, virtual patching, filtering, rate limiting, and application perimeter protection.
- Practical experience with cloud security, preferably AWS and Kubernetes/EKS.
- Experience with security automation, scripting, or programming, preferably Python.
- Strong communication and relationship-management skills for working with developers, vendors, and control owners.
- Experience using AI-enabled security tooling or automation for vulnerability triage and remediation is preferred.
- Cloudflare Zero Trust and Cloudflare Edge experience is preferred.
- OSCP, OSCP+, or an equivalent security certification is preferred.
Tech Stack
Categories
About Accelerant
Accelerant builds a data-driven risk exchange for specialty insurance, connecting MGAs and underwriters with aligned risk capital and software to run their programs. Its platform ingests and analyzes underwriting and claims data to support pricing, capacity allocation, and operations, and it partners closely with specialty underwriting teams. Founded in 2018 and headquartered in Atlanta, the company focuses on improving efficiency and profitability for program-based insurance businesses.