Description
GuidePoint Security is seeking a skilled Application Security Engineer to support the Northeast Application Security practice. The successful candidate will deliver application security engineering services to clients, including implementing, operationalising, and tuning SAST tooling, integrating security controls into CI/CD pipelines, and adopting secure development practices across the SDLC.
The Application Security Engineer will engage in developing automated security testing capabilities, custom detection rules, and secure pipeline patterns while providing excellent service to clients and/or internal customers or co-workers. The ideal candidate will demonstrate strong software engineering, security automation, and client communication skills, lead by influence, and possess strong business/financial acumen to drive progressive DevSecOps and shift-left security programs.
Responsibilities:
- Implement, operationalise, and troubleshoot SAST platforms within client environments
- Design and integrate automated security testing into CI/CD pipelines
- Author and adapt custom SAST rules and triage, validate, and guide remediation of identified vulnerabilities
- Advise client development teams on OWASP Top 10, threat modelling, and secure coding practices throughout the SDLC
- Leverage AI-assisted tooling to accelerate rule development, triage, and remediation guidance
- Contribute to reusable pipeline patterns, rule libraries, and delivery accelerators for the AppSec practice
- Deliver engagements for clients across the Northeast/Mid-Atlantic region, with occasional on-site presence as needed
Requirements:
- Proficiency with SAST tools such as Semgrep, Snyk, CodeQL, Checkmarx, Veracode, etc.
- Understanding of CI/CD pipeline tools and processes
- Experience in software engineering, ideally full-stack software development
- Strong scripting and automation experience using one or more programming languages
- Solid working knowledge of application security fundamentals, including OWASP Top 10, threat modelling, and implementing secure coding practices throughout the SDLC
- Excellent written and verbal communication skills
Preferred Experience and Education:
- Experience writing or adapting custom SAST rules
- Familiarity with additional Application Security tools
- Familiarity with API Security tools
- Practical hands-on experience validating vulnerabilities and proficiency with Burp Suite
- Strong working knowledge of Secure Development Lifecycles and experience triaging and remediating technical vulnerabilities
Benefits:
- Remote workforce primarily
- Group Medical Insurance options
- Group Dental Insurance
- 12 corporate holidays and a Flexible Time Off program
- Healthy mobile phone and home internet allowance
- Eligibility for retirement plan after 2 months at open enrollment
- Pet Benefit Option