Overview
The Senior Application Security Engineer will work closely with development teams to integrate security practices into the software development lifecycle. This role involves shaping application security tooling, deploying controls, and advising on secure software design, specifically within a health research context. The engineer will collaborate with a small Information Security team while also supporting engineering teams in adopting security measures across platforms such as Azure and GitHub Actions.
Responsibilities
- Deploy and operate application security scanners, integrating them into CI/CD pipelines to assist developers in rectifying security findings.
- Build and automate security controls for Azure, AKS, and container workloads using Python and Terraform.
- Enhance the secure development lifecycle by conducting threat modeling, secure design reviews, and providing API security guidance.
- Secure data platforms including Databricks, Dagster, and Snowflake.
- Educate and support engineering teams in the rollout and documentation of security tooling.
Requirements
- Demonstrated experience in Application Security, Product Security, or DevSecOps, with examples of implemented security controls.
- Proficiency in integrating application or dependency scanning into CI/CD processes, including SAST, DAST, IAST, or SCA.
- Strong practical skills in Python and Terraform, with experience securing Kubernetes or container workloads.
- Familiarity with GitHub Actions, Azure, and AKS is essential.
- Knowledge of OPA, Azure Policy, or cloud data platform security is a plus.