Application Security

Application Security Cybersecurity Jobs

125 jobs found

Today

Lead Cybersecurity Architect- Data

JPMorganChase Jersey City, NJ

Jersey City, NJ

Today

$152k - $215k/yr Full time Application Security Big Data Cloud

Apply Now

Job Description

JPMorganChase is seeking a Lead Cybersecurity Architect - Data to design and implement data protection controls across cloud and hybrid environments. This role communicates risk and remediation strategies to stakeholders and guides the technical direction for data-centric cybersecurity solutions, with an onsite placement in Jersey City, NJ. The compensation range for this position is USD 152,000 - 215,000 per year.

Responsibilities

Architect and assess data security controls across cloud and hybrid platforms (Databricks, Snowflake, AWS, GCP), covering storage, compute, analytics, and streaming services.
Collaborate with technical teams and business stakeholders to discuss and propose approaches that meet current and future cybersecurity needs.
Define the technical target state of the cybersecurity product and drive strategy execution to achieve it.
Identify opportunities to automate remediation of recurring issues to improve cybersecurity across software applications and systems.
Lead evaluation sessions with external vendors, startups, and internal teams to drive continuous improvement and assess cybersecurity design and credentials for use in existing systems and architecture.
Lead communities of practice to promote awareness and adoption of new and leading-edge cybersecurity technologies.
Foster a team culture grounded in diversity, opportunity, inclusion, and respect.

Requirements

Formal training or certification with at least five years of experience in Data Technologies.
Hands-on practical experience delivering enterprise-level cybersecurity solutions and controls.
Advanced proficiency in one or more programming languages, with strong capabilities in automation and continuous delivery methods.
Strong understanding of all aspects of the Software Development Life Cycle.
Deep knowledge of agile methodologies, including continuous integration and delivery, application resiliency, and security practices.
Demonstrated proficiency in software applications and technical processes within a technical discipline (e.g., public cloud, AI/ML, mobile, etc.).
Practical cloud-native experience.
Deep knowledge of one or more software domains and applications.
Ability to evaluate current and emerging technologies to recommend optimal solutions for the future state architecture.
Experience communicating effectively with senior business leaders.

Technologies

Databricks
Snowflake
AWS
GCP
Python
Java

Benefits

Comprehensive health care coverage
On-site health and wellness centers
Retirement savings plan
Backup childcare
Tuition reimbursement
Mental health support
Financial coaching

Preferred Qualifications

Proven experience in data security architecture (or security architecture with substantial data platform scope) delivering enterprise-scale controls.
Strong knowledge of data security concepts such as classification, access controls, encryption, tokenization/masking, DLP, retention, and secure sharing.
Cloud security architecture for data services including storage, analytics, and messaging/streaming.
Identity and access management patterns (federation, service identities, least privilege, ABAC/RBAC).
Experience performing threat modeling, security design reviews, and risk assessments for complex data flows and distributed systems.
Working familiarity with secure engineering practices and common vulnerabilities (e.g., OWASP) as they apply to data APIs and services.
Proficiency or strong working knowledge in one or more languages (e.g., Python, Java) and Infrastructure-as-Code concepts.
Familiarity with security and privacy frameworks/regulations (e.g., NIST, GDPR, HIPAA where applicable).
Preferred Certifications such as AWS Certified Solutions Architect, Databricks, Snowflake, or Data Engineering.

View full job page →

Today

Staff Product Security Engineer, Reviews

Okta Chicago, IL

Chicago, IL

Today

$180k - $248k/yr Full time Application Security Cybersecurity Tools Dynamic Application Security Testing

Apply Now

Job Description

Okta, a leader in identity and access management, is seeking a Staff Product Security Engineer to lead security reviews, threat modeling, and vulnerability management across its product portfolio. Based in Chicago with a hybrid work arrangement, this role focuses on secure design, code analysis, and the security of authentication protocols and AI-enabled features. The position offers a compensation range of USD 180,000 to 247,500 per year.

Responsibilities

Perform security assessments on new features and major changes, including design reviews, threat modeling, and penetration testing.
Carry out manual secure-code reviews across multiple programming languages.
Identify vulnerabilities and guide engineering teams on remediation strategies.
Take the lead on product security incidents, assess risks, and steer remediation efforts.
Create security tooling and automation to enhance vulnerability detection and evaluation.
Mentor junior engineers and advise non-security staff on secure development practices.
Represent Okta in external security research, conference presentations, and publications.

Requirements

Proficient at identifying OWASP Top 10 and CWE Top 25 vulnerabilities via manual code review.
Solid background in penetration testing and secure development lifecycle practices.
Deep technical expertise in evaluating Large Language Models and securing AI-enabled software architectures.
Proficient in multiple languages such as Java, Go, Python, and C/C++.
Strong understanding of authentication and authorization protocols including OIDC, SAML, and OAuth.
Excellent communication skills to convey risks and remediation plans to developers and leadership.
Ability to automate security testing using LLMs and scripting languages like Python and Bash.
Experience leading security incidents and conducting risk assessments.

Technologies

Java, Go, Python, C/C++, Bash
SAML, OAuth, OIDC
Large Language Models (LLMs)
SAST, DAST, SCA, fuzzing tools

Benefits

Supporting Your Well-Being
Driving Social Impact
Developing Talent and Fostering Connection + Community

Desired Skills and Abilities

Experience conducting security testing on mobile (iOS/Android) and desktop (Windows/macOS) platforms.
Familiarity with SAST, DAST, SCA and fuzzing tools.
Strong cryptographic knowledge and secure implementation practices.
Experience analyzing network protocols and securing network traffic.
Ability to develop proof-of-concept exploits to demonstrate vulnerabilities.

View full job page →

Today

Lead ISSE / Cloud Security Engineer

Bowhead Montgomery, AL

Montgomery, AL

Today

Full time Senior Application Security Azure

Apply Now

Job Description

Bowhead invites an experienced security professional to join onsite in Montgomery, AL as a Lead ISSE / Cloud Security Engineer. In this role within the Cloud Acceleration Services (CAS) and Business Enterprise Systems (BES) programs, you will design and validate security controls for cloud and hybrid environments, helping safeguard critical systems and data.

Responsibilities

Implement secure IAM, RBAC, and PAM controls and evaluate Zero Trust integration across environments.
Support STIG, SCAP, ACAS, and broader security testing activities.
Review penetration test findings and determine remediation steps.
Engineer remediation strategies for cloud hosted and containerized applications.

Requirements

Bachelor's degree in Cybersecurity, Computer Science, Engineering, Information Systems, or a related discipline.
Minimum of 10 years in cybersecurity engineering, with at least 5 years supporting cloud security, DevSecOps security, or RMF engineering for DoD or federal cloud-hosted systems.
Certifications: CISSP, CCSP, CASP+ or equivalent required or preferred; Security+ is required; AWS Security Specialty, Azure Security Engineer, or Kubernetes security certification is preferred.
Proficient to advanced skills in the Microsoft Office suite (Word, Excel, Outlook, PowerPoint).
Ability to communicate effectively with employees at all levels and with external contacts.
Strong interpersonal skills and sound judgment with the ability to work independently or as part of a team.

Technologies

AWS
Azure
Kubernetes
ACAS
Microsoft Word
Microsoft Excel
Microsoft Outlook
Microsoft PowerPoint

Physical Demands

Must be able to lift up to 25 pounds
Must be able to stand and walk for prolonged periods
Must be able to twist, bend and squat periodically

Security Clearance Requirements

Must be able to maintain a security clearance at the Secret level. Top Secret is preferred. US Citizenship is a requirement for Secret clearance at this location.

View full job page →

Today

Senior Staff Product Security Engineer

Draeger Medical Systems, Inc. Andover, MA

Andover, MA

Today

$140k - $169k/yr Full time Senior Application Security Cybersecurity Tools

Apply Now

Job Description

Hybrid work in Andover, MA with a competitive annual salary and a benefits-forward culture anchored by the principle Technology for Life.

Salary range: USD 140,400 - 168,500 per year.

Medical, dental, and vision insurance
Life, short- and long-term disability coverage
401(k) with company match
Over 4 weeks of paid time off, plus holidays and parental leave
Flexible spending accounts and employee assistance program
Free parking (select locations)
On-site gym (select locations)
Cafeteria (select locations)
Game room (select locations)

Responsibilities

Define long term product cybersecurity strategy and enterprise security architecture direction.
Establish global cybersecurity design standards and governance frameworks across product portfolios.
Lead enterprise level vulnerability management strategy and risk prioritization decisions.
Represent the organization in regulatory engagements and industry cybersecurity initiatives.
Drive alignment with evolving global cybersecurity regulations and standards.
Define cybersecurity metrics and continuous improvement initiatives.
Develop senior engineering capability and provide technical mentorship.
Performs other duties as needed and assigned.

Requirements

Bachelor of Science in Computer Science, Cybersecurity, Computer Engineering, or related discipline.
Master preferred.
10 or more years of experience in cybersecurity engineering within regulated medical device or similar industries.
Demonstrated enterprise level influence in cybersecurity strategy and regulatory alignment.
Cybersecurity Certifications: CISSP ISSMP Information Systems Security Management Professional, Offensive Security Certified Professional OSCP, GIAC Enterprise Defender GCED; Equivalent advanced enterprise level cybersecurity certifications will be considered.
Ability to define enterprise product cybersecurity strategy aligned with evolving global regulatory expectations.
Experience adjudicating complex cybersecurity risk decisions balancing patient safety and system availability.
Representation of the organization in regulatory discussions and industry cybersecurity forums.
Enterprise vulnerability management platforms
Security architecture modeling tools
Metrics and governance reporting platforms

Technologies

Enterprise vulnerability management platforms
Security architecture modeling tools
Metrics and governance reporting platforms

Who we are

We are hiring and invite contributions that make a real difference. Draeger operates under the guiding principle Technology for Life. Our North America footprint includes sites across the U.S. and Canada, with the North America headquarters in Telford, PA, and locations in Andover, MA and Houston, TX, plus Mississauga, Ontario.

Draeger is an Equal Opportunity Employer.

Interested candidates should apply directly through our career portal.

View full job page →

Today

Staff Security Engineer

Okta San Francisco, CA

San Francisco, CA

Today

$134k - $185k/yr Full time Senior Application Security Cloud Platforms

Apply Now

Job Description

Okta seeks a hands-on Staff Security Engineer to strengthen security across infrastructure, cloud, and business systems within the TDI Security team, building centralized posture analytics, automating issue tracking and remediation, and advancing secure development with AI-enabled security at scale.

Responsibilities

Elevate the Security Posture Management program to address issues surfaced by security tooling across the ecosystem.
Utilize dashboards and visualization tools to reveal vulnerability trends, progress in issue management, and current status.
Oversee Okta's Security Posture Management program, integrating data ingestion pipelines, prioritizing vulnerability fixes, aiding teams remediating from tools (ISPM, DSPM, Qualys, etc), and building scalable automated systems.
Configure and expand scanning coverage by deploying tools such as Snyk, Semgrep, and Qualys across all TDI assets.
Collaborate with cross-functional teams to troubleshoot findings and provide technical mentorship to developers and admins.
Develop and maintain metrics, reporting, and executive visibility from tools like ISPM/SSPM, Snyk, Semgrep, Qualys, Cyera, and other platforms to drive ownership and risk reduction.
Partner with Security and GRC to communicate risk posture and remediation status.
Advise product and engineering teams on secure coding, build pipelines, and deployment best practices.
Support and enforce ProdSec SDL adoption across business units, standardizing design reviews and requirements gathering.
Implement secrets rotation automation and best practices for secrets management across TDI systems.
Lead shift left security initiatives to bake security into the SDLC.
Collaborate with SRE to manage update pipelines and ensure compliance with baseline standards.
Perform light Security Architecture Reviews for lower environments to confirm proper controls and data handling.
Develop agentic automation to scale security posture scanning, reporting, remediation, and patch validation.
Architect end-to-end automation flows and system designs for an AI agent and its subagents (remediation agent, posture triage agent, etc).
Identify and close gaps across CSPM, CI/CD pipeline security, and endpoint hardening.
Provide technical guidance for integrating security into business and productivity platforms (Salesforce, ERP, Google Workspace, Slack, Zoom).

Requirements

10+ years of experience in Security Engineering, DevSecOps, Infrastructure Security, or SaaS apps within SaaS or enterprise environments.
Hands-on expertise in scanning, patching, and remediating issues across cloud and SaaS ecosystems.
Creative and strategic thinking to promote risk reduction through secure design and simplicity.
Broad security knowledge enabling connections across multiple security domains.
Strong ability to collaborate cross-functionally while balancing security requirements with business goals.
Experience deploying and managing Snyk, Semgrep, and Qualys.
Solid knowledge of AWS security practices, SRE principles, and securing stacks such as Salesforce, ERP, Google, Slack, and Zoom.
Proven track record coaching development teams to improve remediation velocity.
Practical understanding of secure SDLC / PDLC, supply chain security, and secrets management.
Experience building security tools and automated applications.
Effective communication skills for strategic conversations with leadership and hands-on contributors; proficient with visualization/BI tools for dashboards and reporting.
Experience driving remediation across posture-management findings; excellent troubleshooting and proactive, solution-oriented mindset.

Technologies

Snyk
Semgrep
Qualys
ISPM
SSPM
Cyera
AWS
Salesforce
ERP
Google Workspace
Slack
Zoom

Benefits

Supporting Your Well-Being
Driving Social Impact
Developing Talent and Fostering Connection + Community

The Okta Experience

Supporting Your Well-Being
Driving Social Impact
Developing Talent and Fostering Connection + Community

View full job page →

Today

Application Security Engineer - AI Trainer

DataAnnotation Silver Spring, MD 🇺🇸 Remote

Silver Spring, MD

Today

$50 - $100/hr Contract Ai Security Ai Trainer Ai Training

Apply Now

Job Description

Remote contract role based in Silver Spring, MD, to train AI security models by evaluating AI-generated security content, solving security problems, and delivering feedback to shape model development.

Responsibilities

Assess AI generated cybersecurity content, including threat analyses, vulnerability assessments, and offensive security techniques, for accuracy and real world relevance.
Design and solve security oriented technical challenges used to train AI systems.
Produce clear technical explanations and security relevant code.
Provide actionable feedback that directly informs the next generation of AI security models.

Requirements

2+ years of hands-on experience in a cybersecurity role, such as penetration testing, red teaming, incident response, detection engineering, DFIR, malware analysis, threat intelligence, or related fields, including government or military cyber operations.
Some coding experience required; comfort navigating and patching a codebase is key.
Fluency in English with strong writing skills (native or bilingual level).
Bachelor's degree is preferred.
Cybersecurity certifications are a plus (e.g., OSCP, CRTO, GREM, GCFA, CEH, and similar).

Benefits

Fully remote: work from anywhere in the US, Canada, UK, Ireland, Australia, and New Zealand.
Flexible schedule: choose projects and hours, on your own computer, from home.
Competitive pay: hourly rate from $50 to $100 USD, with opportunities for higher bonus rates on select projects.
Impact: contribute to shaping AI technologies designed for cybersecurity.

Note

Payment is processed via PayPal. We will never ask for money from you. This role is open to residents of the US, Canada, UK, Ireland, Australia, and New Zealand.

View full job page →

Today

Delivery Senior Consultant, Penetration Tester

Deloitte Gilbert, AZ

Gilbert, AZ

Today

Full time Application Security Burp Suite Consultant

Apply Now

Job Description

Delivery Senior Consultant, Penetration Tester role in Gilbert, AZ (hybrid) focused on evaluating the security of web applications, APIs, and related systems through hands-on testing and remediation guidance.

Responsibilities

Execute both manual and automated security testing of web applications, APIs, and supporting infrastructure.
Identify, validate, and document vulnerabilities, including items mapped to the OWASP Top 10.
Perform authenticated and unauthenticated testing across development, test, and production-like environments.
Evaluate application security controls such as authentication, authorization, session management, input validation, and encryption.
Produce clear, risk-based reports detailing technical findings, business impact, proof of concept, and remediation guidance.
Collaborate with developers, architects, and security teams to explain findings and support remediation efforts.
Retest remediated issues and verify closure of findings.
Contribute to security standards, testing methodologies, and internal knowledge sharing.
Maintain awareness of emerging threats, exploit techniques, and trends in application security.

Requirements

Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical field.
Ability to obtain and maintain the necessary clearance for the role.
Certifications such as OSCP, OSWE, GPEN, or CEH.
2+ years of experience in web application focused penetration testing.
Strong understanding of web technologies including HTTP/S, REST APIs, JavaScript, cookies, headers, and sessions.
Experience identifying vulnerabilities such as SQL injection, XSS, CSRF, SSRF, IDOR, authentication flaws, and access control weaknesses.
Proficiency with testing tools such as Burp Suite, OWASP ZAP, Nmap, Postman, and similar tools.
Experience writing professional penetration test reports for technical and non-technical audiences.
Familiarity with OWASP Top 10, CWE, CVSS, and secure coding principles.

Delivery Center Location & Travel Requirements

Hybrid Work Model requiring residence within commutable distance to US Delivery Center locations (Gilbert, Lake Mary, Mechanicsburg) or Geo-Hub locations (Atlanta, Charlotte, Dallas, Houston, Philadelphia).
Co-location up to 30% of working time at an assigned office for projects, training, and related opportunities at Deloitte Delivery Center locations, Geo-Hub locations, approved sites, or project locations.
Travel up to 10% overnight for client or project purposes.
If relocation is necessary, complete the move within 12 weeks from the start date to reside within a commutable distance.
Must be legally authorized to work in the United States without employer sponsorship now or in the future.