[Hiring] Application Security Engineer @GuidePoint Security

Role Description

We are looking for a skilled Application Security Engineer to support the Northeast Application Security practice in delivering application security engineering services to clients, including:

• Implementation, operationalization, and tuning of SAST tooling
• Integration of security controls into CI/CD pipelines
• Adoption of secure development practices across the SDLC

This role will engage in the development of:

• Automated security testing capabilities
• Custom detection rules
• Secure pipeline patterns

The Application Security Engineer will be required to demonstrate:

• Strong software engineering and security automation skills
• Client communication skills
• Business/financial acumen to drive progressive DevSecOps and shift-left security programs

Qualifications

• Proficiency with the implementation, operationalization, and troubleshooting of Static Application Security Testing (SAST) tools such as Semgrep, Snyk, CodeQL, Checkmarx, Veracode, etc.
• Understanding of Continuous Integration / Continuous Delivery (CI/CD) pipeline tools and processes (e.g. GitHub Actions, GitLab Runners, Azure DevOps, Jenkins, CircleCI, etc.)
• Experience in software engineering, ideally full stack software development, including modern technologies and application architectures
• Strong scripting and automation experience using one or more programming languages
• Solid working knowledge of application security fundamentals including the OWASP Top 10, threat modeling, and implementing secure coding practices throughout the Software Development Lifecycle (SDLC)
• Excellent written and verbal communication skills

Requirements

• Implement, operationalize, and troubleshoot SAST platforms (e.g., Semgrep, Snyk, CodeQL, Checkmarx, Veracode) within client environments
• Design and integrate automated security testing into CI/CD pipelines (e.g., GitHub Actions, GitLab Runners, Azure DevOps, Jenkins, CircleCI)
• Author and adapt custom SAST rules (Semgrep, CodeQL) and triage, validate, and guide remediation of identified vulnerabilities
• Advise client development teams on OWASP Top 10, threat modeling, and secure coding practices throughout the SDLC
• Leverage AI-assisted tooling to accelerate rule development, triage, and remediation guidance
• Contribute to reusable pipeline patterns, rule libraries, and delivery accelerators for the AppSec practice
• Deliver engagements for clients across the Northeast/Mid-Atlantic region, with occasional on-site presence as needed

Preferred Experience and Education

• Experience writing or adapting custom SAST rules (Semgrep or CodeQL)
• Familiarity with additional Application Security tools (e.g. Interactive (IAST), Dynamic (DAST) and API security, SCA, etc.)
• Familiarity with API Security tools (e.g., NoName, Traceable, Salt, Cequence)
• Practical hands-on experience validating vulnerabilities and proficiency with Burp Suite
• Strong working knowledge of Secure Development Lifecycles and experience triaging and remediating technical vulnerabilities identified by web application scanning tools
• Understanding of automated security testing approaches and tools
• Experience in building and operating security tools within CI/CD pipelines
• Experience with proactive integration of security into the development process
• Past experience as an application security practitioner or software engineer

Travel Requirements

• Up to 10% travel

Physical Requirements

• Sedentary work
• Substantial movement of the wrists, hands, and/or fingers for a minimum of 8 hours a day
• Required to have close visual acuity to view computer terminal and/or extensive reading for a minimum of 8 hours a day

Benefits

• Remote workforce primarily (U.S. based only, some travel may be required for certain positions, working on-site may be required for Federal positions)
• Group Medical Insurance options: Zero Deductible PPO Plan or High Deductible Health Plan with HSA
• Group Dental Insurance: GuidePoint pays 100% of the premium for employees and 75% of family plans
• 12 corporate holidays and a Flexible Time Off (FTO) program
• Healthy mobile phone and home internet allowance
• Eligibility for retirement plan after 2 months at open enrollment
• Pet Benefit Option