Application Security Engineer - Mid-Atlantic region (Remote in VA, MD, PA, NC, DE, NJ, or DC)

The role

The Application Security Engineer will implement, operationalize, and troubleshoot SAST tools. They will work with CI/CD pipeline tools and apply application security fundamentals throughout the SDLC.

What you will do

• Implementation, operationalization, and troubleshooting of Static Application Security Testing (SAST) tools
• Use of Continuous Integration / Continuous Delivery (CI/CD) pipeline tools and processes
• Apply application security fundamentals including OWASP Top 10 and threat modeling
• Implement secure coding practices throughout the Software Development Lifecycle (SDLC)
• Embrace emerging technologies including AI tools to solve problems

Required qualifications

• Proficiency with the implementation, operationalization, and troubleshooting of Static Application Security Testing (SAST) tools such as Semgrep, Snyk, CodeQL, Checkmarx, Veracode, etc.
• Understanding of Continuous Integration / Continuous Delivery (CI/CD) pipeline tools and processes
• Experience in software engineering, ideally full stack software development, including modern technologies and application architectures
• Strong scripting and automation experience using one or more programming languages
• Solid working knowledge of application security fundamentals including the OWASP Top 10, threat modeling, and implementing secure coding practices throughout the Software Development Lifecycle (SDLC)
• Excellent written and verbal communication skills
• Bachelor’s degree in a relevant discipline or equivalent experience
• 5-7 years of security engineering experience in the Information Security industry

Nice to have

• Experience writing or adapting custom SAST rules (Semgrep or CodeQL)
• Familiarity with additional Application Security tools (e.g. Interactive (IAST), Dynamic (DAST) and API security, SCA, etc.)
• Familiarity with API Security tools (e.g. NoName, Traceable, Salt, Cequence)
• Practical hands-on experience validating vulnerabilities and proficiency with Burp Suite
• Strong working knowledge of Secure Development Lifecycles and experience triaging and remediating technical vulnerabilities identified by web application scanning tools
• Understanding of automated security testing approaches and tools
• Experience in building and operating security tools within CI/CD pipelines
• Experience with proactive integration of security into the development process
• Past experience as an application security practitioner or software engineer

Benefits

• Remote workforce primarily
• Group Medical Insurance options: Zero Deductible PPO Plan or High Deductible Health Plan with HSA
• Group Dental Insurance
• 12 corporate holidays
• Flexible Time Off (FTO) program
• Healthy mobile phone and home internet allowance
• Eligibility for retirement plan after 2 months at open enrollment
• Pet Benefit Option

Before you apply

• Applicants must be authorized to work for any employer in the U.S.
• Unable to sponsor or take over sponsorship of an employment visa for this role

About the company

GuidePoint Security is a rapidly growing, profitable, privately-held value added reseller that focuses exclusively on Information Security. It serves as a trusted advisor to more than 6,200 customers.