Information Security Specialist (Application Security II)

Description

• Work with CloudOps on runtime guardrails, including secrets management, identity controls, and logging practices.
• Partner with InfoSec to support customer security questionnaires, audits, and external security posture communications.
• Support and enable Security Champions across squads through mentorship, training, and playbooks.
• Evaluate the security maturity of products, identify gaps, and partner with engineering to close them.
• Deliver security awareness sessions and workshops to uplift team security knowledge.
• Stay up to date on security trends, tools, and best practices, and share knowledge with engineering teams.
• Assist in security incident investigations related to application-layer vulnerabilities and support remediation planning.
• Promote secure coding practices and define reusable secure patterns, golden paths, and developer guides.
• Lead and facilitate threat modeling for critical features and systems, and drive mitigation strategies with engineering teams.
• Conduct security assessments of web apps, APIs, cloud-native services, and internal tooling using manual and automated approaches.
• Design and implement security tooling and automation in CI/CD pipelines (SAST, secrets scanning, dependency checks, IaC scanning) to integrate security at build-time.
• Collaborate on application security design, providing guidance on authentication, authorization, encryption, input validation, error handling, and data protection.

Requirements

• Solid understanding of web application security (e.g., OWASP Top 10, ASVS) and common vulnerabilities
• Bonus: Experience supporting data security initiatives or customer security assessments.
• 6+ years experience in application security or DevSecOps roles.
• Hands-on experience with security tooling in CI/CD pipelines (e.g., SAST, SCA, secrets scanning, IaC scanning).
• Strong communication skills, able to collaborate effectively across engineering, CloudOps, and InfoSec teams.
• Experience in secure architecture, threat modeling, and design reviews.
• Bonus: Familiarity with cloud-native environments (AWS, GCP, Azure)
• Proficiency with a modern programming language (Python, TypeScript, JavaScript, or similar).

Benefits

Training + Development

Interview process

Visa Sponsorship

Security clearance