RemoteLeaf Logo
Log in Sign up

Staff Application Security Engineer (R5949)

1 week, 3 days ago
Anywhere
Full-time
Lead
Application Security Engineer
Cybersecurity
Burp Suite CI/CD DevSecOps Kubernetes Microservices SonarQube
Apply Now
Bitly

Bitly

Bitly is a link management platform offering URL shortening, QR codes, and a Link in Bio solution for brands to optimize customer experience.

Internet Software & Services
201-500
Founded 2008
$92M raised
View All Jobs 12

Description

  • Establish and continuously improve company-wide secure SDLC policies, standards, controls, procedures, and evidence requirements.
  • Translate security policies into practical requirements and guardrails for product, platform, and development teams.
  • Assess engineering, CI/CD, source-control, build, and release maturity and lead improvement roadmaps.
  • Implement and operationalize AppSec tooling, including SAST, DAST, SCA, secrets detection, IaC scanning, and container security scanning.
  • Partner with development teams to triage, remediate, and verify application-security findings.
  • Lead threat modeling, security requirements definition, and secure design and architecture reviews for high-risk changes.
  • Establish risk-based vulnerability management, open-source governance, and dependency remediation processes.
  • Mature software supply-chain controls including SBOMs, provenance, signing, artifact verification, trusted promotion, and SLSA-aligned practices.
  • Work with DevOps and platform teams to secure CI/CD pipelines, repositories, build systems, registries, and deployment workflows.
  • Lead a security champions program and develop metrics, reporting, and audit support for the AppSec program.

Requirements

  • 7+ years of experience in application security, product security, DevSecOps, secure software engineering, cybersecurity engineering, or a related field.
  • Experience designing, implementing, or maturing a secure SDLC or application-security program across multiple engineering teams.
  • Strong knowledge of secure coding, application-security testing, vulnerability management, software delivery, and DevSecOps principles.
  • Hands-on experience with SAST, DAST, SCA, dependency vulnerability management, secrets scanning, and related tooling.
  • Experience integrating security controls into source control, CI/CD, build, release, and deployment workflows.
  • Experience with threat modeling, security design or architecture reviews, and security requirements definition.
  • Knowledge of application-security risks including authentication, authorization, API security, injection, insecure dependencies, secrets exposure, and business-logic vulnerabilities.
  • Experience with software supply-chain security, including SBOMs, dependency provenance, build integrity, artifact signing, release attestations, and secure artifact management.
  • Familiarity with NIST SP 800-218/SSDF, OWASP SAMM, SLSA, or comparable secure-development frameworks.
  • Ability to assess production code and scripts in modern programming languages and communicate technical risk to technical and nontechnical stakeholders.
  • Experience with cloud-native applications, containers, Kubernetes, APIs, microservices, or infrastructure-as-code security (preferred).
  • Experience with tools such as Snyk, Checkmarx, Veracode, GitHub Advanced Security, Semgrep, SonarQube, OWASP ZAP, Burp Suite, Mend, or Black Duck (preferred).

Benefits

  • Salary within the listed range, influenced by experience, skills, certifications, and location.
  • Bonus opportunity for full-time regular employees.
  • Equity for full-time regular employees.
  • Benefits package for full-time regular employees.
  • Temporary benefits package after 60 days of employment for eligible temporary employees.

Interested in this position?

Apply directly on the company website

Apply Now

Similar Roles

ClearCapital.com,

Senior Application Security Engineer

ClearCapital.com, 1-10 Real Estate

As a Sr. Application Security Engineer, strengthen the security of application services, connected systems, and AI-enabled products by identifying vulnerabilities and driving secure development practices across the software lifecycle.

United States Full-time Senior Application Security Engineer
$111k-$144k
AWS C++ Java JavaScript Penetration Testing PHP PowerShell Python Ruby
1 hour, 3 minutes ago
HITCONTRACT

Senior DevSecOps and Vulnerability Management Engineer

HITCONTRACT 11-50 Professional Services

Join an international IT company as a Senior DevSecOps and Vulnerability Management Engineer to strengthen CI/CD, cloud, and vulnerability security for a US public-sector SaaS platform across a diverse multi-product estate.

Lithuania Poland Contract Lead Application Security Engineer
$89k-$98k
Argo CD AWS Azure C# CI/CD Datadog DevSecOps GitHub Actions Groovy Helm Java Jenkins Kubernetes Node.js PHP Power BI Ruby TypeScript
1 hour, 33 minutes ago
OneStream Software

Application Security Engineer

OneStream Software 1001-5000 Internet Software & Services

OneStream is hiring a remote Application Security Engineer to strengthen the security of its modern Finance platform by embedding practical application security throughout the software development lifecycle.

United States Full-time Mid Level Application Security Engineer
$114k-$148k
Burp Suite C# CI/CD DevSecOps .NET PowerShell Python
2 days, 22 hours ago
Lever

Web Developer Security Engineer

Lever 201-500 Professional Services

Spry Methods seeks a Web Developer Security Engineer to embed application security across mission-critical federal and DoD web applications, APIs, and sensitive data throughout the software development lifecycle.

United States Full-time Mid Level Application Security Engineer
$135k-$155k
CSS Cybersecurity DevSecOps HTML JavaScript .NET REST API SQL
1 week ago

You're on a roll! Sign up now to keep applying.

Sign Up

Already have an account? Log in

Used by 14,729+ remote workers