Principal Engineer - Application Security (AI security, Pen Testing, DevSecOps)

Job summary

The Principal Application Security Engineer is responsible for leading the enterprise Application Security program, focusing on secure development practices and integrating security into the software development lifecycle. Key responsibilities include guiding engineering teams in vulnerability remediation, designing automation for CI/CD pipelines, and leveraging AI technologies to enhance application security processes.

Qualifications

• 10+ years of experience in software engineering or application security.
• Expertise in SSDLC, SAST, DAST, SCA, Threat Modeling, and Penetration Testing.
• Strong software development experience in modern programming languages.
• Experience integrating security into CI/CD pipelines.
• Proven experience building Application Security programs.
• Experience with AI technologies in security operations.
• Ability to evaluate and govern AI-enabled solutions.
• Excellent communication and collaboration skills.
• Ability to influence technical direction across teams.
• Experience securing cloud-native applications in AWS, Azure, or Google Cloud.
• Experience with Kubernetes, containers, APIs, and microservices.
• Experience developing custom security tooling.

Responsibilities

• Provide technical leadership across Secure Software Development Lifecycle (SSDLC), Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), Threat Modeling, and Penetration Testing.
• Guide engineering teams in vulnerability remediation and secure coding best practices.
• Evaluate emerging application security technologies and recommend risk-based improvements.
• Partner with Security Architecture to align application security practices with enterprise standards.
• Design and build automation for CI/CD pipeline security integration.
• Develop tooling and APIs to enhance developer experience.
• Implement security controls within modern development workflows.
• Leverage AI technologies to improve application security processes.
• Define the technical roadmap for the Application Security program.
• Develop strategies to scale security through automation and self-service capabilities.
• Create security guidance, reusable frameworks, and training.
• Establish metrics to measure program effectiveness.
• Influence technical decisions through collaboration.
• Communicate security risks to diverse audiences.
• Mentor engineers on security best practices.
• Solve complex application security challenges.
• Drive continuous improvement in security tooling and workflows.
• Lead investigations of significant application security issues.

Skills

Certifications

Degrees

Relocation