Appsec Ci/cd

Appsec Ci/cd Cybersecurity Jobs

2 jobs found

Today

Sr Application Security Engineer

BJ's Wholesale Club, Inc. Marlborough, MA

Marlborough, MA

Today

$100k - $132k/yr Full time Senior Application Security Application Security Engineering

Apply Now

Job Description

BJ’s Wholesale Club, Inc. is hiring a Sr Application Security Engineer to help secure software powering digital, e-commerce, and club-facing experiences. This is an individual contributor role with a focus on threat modeling, running and tuning an application security testing tool chain, and partnering with engineering teams to deliver secure software.

Based in Marlborough, MA (hybrid), the role supports security activities across customer-facing and internal platforms, including application and API security, Secure SDLC improvements, and application-layer incident support.

What you’ll do

Conduct threat modeling and security reviews for new and existing applications, APIs, microservices, and third-party integrations.
Operate and tune the application security testing tool chain, including SAST, DAST, SCA, dependency analysis, secrets detection, infrastructure-as-code scanning, and container image scanning.
Work with development teams to remediate security defects and provide recommendations for secure coding practices and fixes.
Implement and maintain security controls in CI/CD using policy-as-code and automated testing capabilities for secure software delivery.
Drive Secure SDLC improvements aligned to OWASP SAMM, BSIMM, and NIST SSDF, including maturity assessments and gap closure.
Support API security across discovery and inventory, schema and specification validation, and identification of shadow and zombie APIs.
Develop and maintain secure coding guidance and reusable security resources for development teams, including participation in developer security awareness and security champions initiatives.
Support PCI DSS 4.0.1 application requirements, including secure development practices, change control, client-side script integrity and monitoring for payment pages, and audit evidence collection.
Contribute to penetration testing and responsible disclosure workflows, including scoping input, validating findings, retesting, and root cause analysis.
Automate security testing and evidence collection by integrating security tooling, source control, and Jira to reduce manual effort.
Perform software supply chain security reviews, including open-source governance, SBOM generation and review, and evaluation of third-party and SaaS applications.
Support incident response for application-layer events by performing exploit reproduction, root cause analysis, and recommending control improvements.
Write and maintain application security documentation, runbooks, and standard operating procedures.
Produce metrics and reporting for scanning coverage, Secure SDLC adoption, and the security posture of the application portfolio.

Minimum qualifications

Bachelor’s degree in Computer Science, Information Security, or equivalent practical experience.
4-6 years of hands-on security or software engineering experience, with at least 2 years focused on application or product security.
Working knowledge of at least one modern programming language: Java, C#/.NET, JavaScript/TypeScript, Python, or Go, including the ability to read application code and recognize vulnerable patterns.
Working knowledge of OWASP Top 10, OWASP API Security Top 10, and OWASP ASVS, including explaining exploitability and correct fixes.
Hands-on experience operating enterprise SAST, DAST, and SCA tooling, including onboarding applications and tuning rulesets.
Experience participating in threat modeling using STRIDE (or comparable methodology) and translating findings into actionable security requirements.
Experience integrating security testing into CI/CD pipelines.
Experience securing cloud-native applications in AWS, Azure, and/or GCP, including containerized workloads (Docker required, Kubernetes preferred).
Hands-on scripting and automation experience with Python, Bash, or PowerShell.
Familiarity with frameworks and compliance such as PCI DSS, NIST SSDF, OWASP SAMM, BSIMM, CIS, or ISO 27001 as they apply to software development.
Ability to work independently, manage competing priorities, and make sound technical decisions with limited day-to-day oversight.
Strong communication skills and ability to work effectively with engineering teams.

Technologies

Java, C#/.NET, JavaScript/TypeScript, Python, Go
OWASP Top 10, OWASP API Security Top 10, OWASP ASVS
SAST, DAST, SCA, dependency analysis, secrets detection, infrastructure-as-code scanning, container image scanning
CI/CD, policy-as-code
OWASP SAMM, BSIMM, NIST SSDF, PCI DSS 4.0.1
STRIDE
Docker, Kubernetes, AWS, Azure, GCP
Bash, PowerShell, SBOM, Jira, source control, SLSA, Terraform, CloudFormation

Salary

USD 100,000 - 131,500 per year

Benefits

Weekly Pay
Daily Pay
Free BJ’s Memberships
Generous Paid Time Off
Flexible and Affordable Health Benefits
401(k) Retirement Savings Plan
Employee Stock Purchase Plan

Nice to have

Experience in retail, e-commerce, or other high-volume PCI in-scope environments.
Experience with API security platforms and discovery tooling.
Experience working within an embedded, co-sourced, or managed application security delivery model alongside external partners.
Experience contributing to a security champions program.
Experience supporting bug bounty or responsible disclosure programs.
Offensive security or exploit development background, including CTF or hands-on web application exploitation experience.
Familiarity with infrastructure-as-code such as Terraform or CloudFormation.
Familiarity with software supply chain security practices such as SBOM, SLSA, and artifact signing.
Familiarity with securing AI-assisted development workflows and LLM-integrated applications, including the OWASP Top 10 for LLM Applications.

Preferred certifications

CompTIA Security+
GIAC GWAPT, GWEB, or (ISC)² CSSLP
AWS or Azure Security certifications
OSCP or OSWE
CCSP

Hybrid / work schedule

Tuesday through Thursday: in-office days at BJ’s Club Support Center in Marlborough, MA
Monday and Friday: remote days

View full job page →

Today

Advanced Specialist, Application Security

Pearson Durham, NC

Durham, NC

Today

$100k - $160k/yr Full time Application Security Application Security Testing Appsec Ci/cd

Apply Now

Job Description

Durham, NC (hybrid) role with Pearson offering an annual incentive program eligibility and a full-time salary range of $100,000–$160,000, with compensation influenced by skill set, experience, and location.

In this position, you will own application security across the software development lifecycle for Pearson’s regulated and sovereign estate. You will embed AppSec into product, engineering, DevOps, and release processes, while acting as a technical direction point and escalation path for complex application security challenges.

What you’ll do

Own and continuously improve a repeatable Application Security process across concept and intake, requirements and design, development, build and CI/CD, test and preproduction, release, and production monitoring.
Partner with Enterprise Application Security to define which AppSec activities and tools apply to each phase, what evidence must be produced, who owns the work, and how findings are handled before and after release.
Lead threat modeling, use case review, and secure design reviews, including authentication and authorization design, privacy, and logging requirements.
Set risk-based security gates by ensuring critical and high risk issues are reviewed before release, while lower risk items are tracked to agreed remediation timelines.
Ensure every finding has a clear owner and an SLA, with triage, remediation, acceptance, or closure as not applicable so items are never left open by default.
Own selection, design, onboarding, and optimization of the AppSec toolchain, including SAST, SCA, secrets scanning, IaC scanning, container scanning, DAST, and IAST/RASP.
Operate and mature the AppSec stack across development pipelines and code repositories.
Drive repository and space onboarding to close AppSec coverage gaps and run a discovery loop to identify unscanned origins as the estate changes.
Enforce pipeline policy and artifact integrity using CI/CD gates, SBOM generation, image scanning, and artifact signing.
Automate triage, ticket routing, and evidence collection to reduce manual effort and improve consistency.
Assist with tuning preventative technologies such as RASP and WAF.
Translate FedRAMP 20x, GovRAMP Rev5, NCSC Cyber Assessment Framework, UK Cyber Essentials Plus, and equivalent requirements into concrete AppSec controls and defensible evidence.
Validate that application architecture is deployed correctly against each sovereign requirement, not only documented as compliant.
Provide application penetration test scoping and assurance, and manage remediation follow-up through to closure.
Lead technical audit preparation and evidence quality review, supporting POA&M and continuous monitoring cycles.
Engage directly with 3PAOs, external assessors, and government customers on application control questions.
Act as an application security entry point at project intake and cyber security kickoff by confirming application tier, scantool onboarding, baseline compliance, and go live requirements.
Provide oversight and technical advice to engineers by reviewing security designs and implementations.
Coach developers on secure coding by providing actionable feedback while design and code decisions are still fresh.
Build reusable standards, playbooks, and onboarding materials so AppSec capability scales beyond individuals.
Communicate application risk clearly to engineering teams, business partners, and senior leadership.

Skills and qualifications

Bachelor’s degree in computer science, Information Security, MIS, or an equivalent technical discipline.
Significant hands-on application security experience at a senior or lead level in an enterprise environment.
Deep practical experience with SAST, SCA, secrets scanning, and container/IaC scanning, including tuning, false-positive management, and developer-facing triage.
Proven experience integrating security into CI/CD pipelines and defining risk-based release gates.
Strong threat modeling and secure design review capability (for example, STRIDE), including authentication and authorization architecture.
Working knowledge of OWASP Top 10 and secure coding practices across modern web and API stacks.
Cloud security depth in Azure and/or AWS as it applies to application workloads and boundaries.
Ability to script and automate using Python or comparable languages to reduce manual triage and evidence work.
Experience defining and evidencing technical controls for external audit or penetration test.
Excellent written and verbal communication, credible with developers and executive audiences.

Tools and technologies you’ll work with

SAST, SCA, secrets scanning, IaC scanning, container scanning, DAST, IAST/RASP
CI/CD, SBOM generation, image scanning, artifact signing
RASP, WAF
FedRAMP 20x, GovRAMP Rev5, NCSC Cyber Assessment Framework, UK Cyber Essentials Plus
STRIDE, OWASP Top 10, Azure, AWS, Python
POA&M, 3PAOs
ArmorCode, Wiz (and equivalents)
GDPR, NIS2, EU GDPR, China MLPS/PIPL, Saudi NCA ECC, Australia ASD Essential Eight

Eligible compensation and incentives

This position is eligible to participate in an annual incentive program.
Full-time salary range: $100,000–$160,000.
Compensation at Pearson is influenced by skill set, experience, and location.

Desirable experience

Direct experience supporting a FedRAMP or GovRAMP authorization from the application side.
Familiarity with additional sovereign regimes such as UK Cyber Essentials Plus / NCSC Secure Design Principles, EU GDPR and NIS2, China MLPS/PIPL, Saudi NCA ECC, and Australia ASD Essential Eight.
Experience with vulnerability aggregation and posture management platforms (ArmorCode, Wiz, or equivalents).
Software development background with the ability to review code credibly, not just scan output.
Experience running a developer security enablement or training program.
Experience mentoring engineers or leading a small technical function.
Comfort operating in an agile environment with multiple concurrent regulatory deadlines.
Professional accreditation such as CISSP, CSSLP, CCSP, or equivalent.

View full job page →

Appsec Ci/cd Cybersecurity Jobs

Sr Application Security Engineer

Advanced Specialist, Application Security

Get Appsec Ci/cd Cybersecurity Jobs alerts