Senior Application Security Engineer
The University of Texas at Austin3 months ago
Responsibilities
- Develop and maintain Secure Software Development Lifecycle standards for Azure-hosted applications, Adobe Experience Cloud, and other platforms.
- Perform manual and automated secure code reviews aligned with OWASP Top 10 and CWE Top 25.
- Integrate SAST and SCA into CI/CD pipelines and partner with developers to remediate vulnerabilities.
- Configure and operate Burp Suite for DAST and authorized penetration testing, and use OWASP ZAP and Metasploit for application security testing.
- Triage, prioritize, track, and coordinate vulnerability remediation through a risk-based process.
- Assess Microsoft Azure, other cloud environments, Adobe Experience Cloud, SaaS/PaaS integrations, APIs, authentication, authorization, and data validation practices.
- Assess security for AI/ML models, data pipelines, generative AI applications, robotics and RPA platforms, biomedical systems, and connected medical devices.
- Support application security governance, third-party risk assessments, audits, HITRUST readiness, policies, standards, and procedures.
- Collaborate with development, infrastructure, platform engineering, cybersecurity, clinical, research, and operational teams on threat modeling, incident response, architecture reviews, and secure delivery.
- Communicate technical findings, security risks, recommendations, and risk assessments to technical and executive stakeholders.
Requirements
- Bachelor’s degree in Computer Science, Information Security, Cybersecurity, Software Engineering, or a related field, or an equivalent combination of education and professional experience.
- At least eight years of experience in application security, secure code review, penetration testing, or secure software development.
- Hands-on experience with Burp Suite, OWASP ZAP, and Metasploit.
- Experience with SAST, DAST, and SCA tools such as Checkmarx, Veracode, SonarQube, or similar platforms.
- Experience securing Microsoft Azure and other cloud environments.
- Experience implementing secure coding practices across programming languages and web application frameworks.
- Knowledge of SSDLC methodologies, strong analytical and troubleshooting skills, and excellent written and verbal communication.
- Preferred qualifications include healthcare or higher-education experience, knowledge of HIPAA, HITRUST, NIST CSF 2.0, TAC 202, and UTS 165, and experience with AI/ML security, robotics, RPA, biomedical systems, connected medical devices, QA automation, threat modeling, secure architecture reviews, and TPRM.
- Preferred certifications include OSCP, GWAPT, CSSLP, CEH, and Microsoft Azure Security Engineer Associate (AZ-500).
Benefits
- Hybrid work environment in Austin, Texas, with on-site collaboration as business needs require.
- Regular staff position expected to continue, scheduled for 40 hours per week.
- Retirement plan eligibility through the Teacher Retirement System of Texas, subject to applicable hours and duration requirements.
- May participate in after-hours security testing, incident response, vulnerability remediation, or critical production support.
- A criminal history background check is required for finalists.
- Required application materials include a resume/CV, three work references, and a letter of interest.
About The University of Texas at Austin
UT Health Austin is the clinical practice of Dell Medical School at The University of Texas at Austin, providing primary and specialty care to patients in Central Texas. It operates multidisciplinary clinics across areas such as orthopedics, women’s health, pediatrics, oncology, gastroenterology, endocrinology, infectious disease, and ophthalmology, and bills through insurance and self-pay. Established in 2017 and based in Austin, it integrates care with UT Austin research and training programs.