Senior Application Security Engineer - Southeast region
GuidePoint Security5 hours ago
Remote, United StatesMid Level / Senior
Responsibilities
- Run and tune client SAST, DAST, SCA, secrets, and IaC scanning tools, triage findings, eliminate false positives, and provide prioritized remediation guidance.
- Design and implement security integrations across CI/CD pipelines, source control, IDEs, and ticketing systems, including policy gates and break-the-build criteria.
- Partner with development teams on remediation, secure coding, and developer enablement throughout the SDLC.
- Assess software supply chain controls, including SBOM generation, dependency and container image scanning, artifact signing, and pipeline or runner security.
- Perform threat modeling and security architecture reviews for cloud-native, microservice, container, and infrastructure-as-code environments.
- Use AI-assisted and agentic tooling to accelerate application security testing, triage, reporting, and remediation, and advise clients on secure AI coding-assistant adoption.
- Help mature application security programs through metrics, vulnerability-management SLAs, roadmaps, and frameworks such as OWASP SAMM, BSIMM, and NIST SSDF.
- Create client-ready deliverables, present findings to technical and executive audiences, and contribute to AppSec practice growth through tooling, methodologies, and knowledge sharing.
- Travel up to 10% as required.
Requirements
- 4–8+ years of experience in Application Security, Web Penetration Testing, DevSecOps, or security-focused agentic software development.
- Proficiency with Burp Suite Pro and strong knowledge of the OWASP Top 10 and OWASP API Security Top 10 and their mitigations.
- Strong knowledge of secure development lifecycles and experience guiding remediation of application-security findings.
- Ability to review source code in one or more of JavaScript/TypeScript, Python, Java, C#, Go, PHP, or C/C++.
- Working knowledge of AWS, Azure, or GCP, containers, and Git-based development workflows.
- Strong written and verbal communication skills for explaining complex issues to technical and executive audiences.
- Preferred experience building agentic AI workflows or security automation with Python, Bash, or PowerShell.
- Preferred experience with SBOM, SLSA, Sigstore, IaC and container security scanning, threat modeling, and AppSec maturity frameworks.
- Preferred certifications include GWAPT, OSWE, OSCP, CSSLP, Certified DevSecOps Professional, or AWS Certified Security – Specialty.
- Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent experience.
Benefits
- Primarily remote U.S.-based workforce; some travel or on-site work may be required for certain positions.
- Up to 10% travel for this role.
- Medical insurance options including a zero-deductible PPO and a high-deductible health plan with HSA contributions.
- Dental insurance with GuidePoint paying 100% of employee premiums and 75% of family premiums.
- 12 corporate holidays and a Flexible Time Off program.
- Mobile phone and home internet allowance.
- Retirement plan eligibility after two months at open enrollment.
- Pet benefit option.
Tech Stack
AWSAzureBashC#C++DockerGitGitHub ActionsGitLab CI/CDGoGoogle Cloud PlatformJavaJavaScriptJenkinsKubernetesPHPPowerShellPythonTerraformTypeScript
Categories
About GuidePoint Security
GuidePoint Security provides cybersecurity consulting, managed services, and value-added reselling/integration of security products for enterprises and U.S. public-sector agencies. Its teams deliver assessments, penetration testing, cloud and application security, identity and access management, endpoint and network protection, and governance services. Founded in 2011 and headquartered in Reston, Virginia, the privately held company serves Fortune 500 organizations and cabinet-level federal agencies.