Application Security Engineer

Truist Bank is seeking an experienced Application Security Engineer to act as a technical specialist in Dynamic Application Security Testing (DAST). This Raleigh, NC onsite role focuses on designing and enhancing DAST capabilities for complex web applications and APIs across the software development lifecycle, with a strong emphasis on authenticated testing validity and reliable assessment outcomes.

Role summary

The Application Security Engineer will validate authenticated assessments, build reusable technical solutions that improve scan accuracy and reliability, and provide technical authority for DAST standards and tooling. The position also serves as an escalation point for complex configuration reviews and evidence-based decision making.

Responsibilities

• Design, configure, test, and continuously improve advanced DAST solutions and technical patterns for complex web applications and APIs
• Perform and validate complex authenticated assessments, including login success, session state, crawl coverage, attack surface coverage, vulnerability results, and overall assessment validity
• Engineer DAST scan policies, authentication workflows, login sequences, session handling, API definitions, custom scripts, integrations, and automation to enable reliable and repeatable testing
• Investigate difficult or undefined assessment problems such as multifactor authentication constraints, incomplete crawling, blocked requests, dynamic application behavior, tool limitations, false positives, false negatives, and inconsistent results
• Use browser, proxy, HTTP, API, logging, and diagnostic techniques to identify root causes and develop practical, reusable solutions
• Analyze and document DAST evidence to separate validated vulnerabilities from suspected false positives, coverage limitations, and inconclusive results, and support remediation verification
• Partner with application and engineering teams to understand runtime behavior, resolve testability constraints, and establish technically appropriate DAST configurations without assuming application readiness
• Act as a technical escalation point by reviewing complex configurations and technical evidence, and share specialized knowledge through peer reviews, troubleshooting sessions, and reusable documentation

Requirements

• Bachelor’s degree or equivalent education, training, and work-related experience
• Minimum of 5 years of experience in security engineering or related cybersecurity roles
• Advanced knowledge of cybersecurity principles, theories, and concepts
• Proven experience applying security practices across the software development lifecycle
• Advanced knowledge of threat modeling, security testing, and penetration testing
• Experience implementing and managing complex information security technologies
• English language fluency (Required)

Technologies

• DAST
• HTTP
• API
• Browser
• Proxy
• Logging

Benefits

• Medical, dental, vision
• Life insurance
• Disability
• Accidental death and dismemberment
• Tax-preferred savings accounts
• 401k plan
• No less than 10 days of vacation (prorated based on date of hire and by full-time or part-time status) during the first year of employment
• 10 sick days (prorated)
• Paid holidays
• May be eligible for Truist’s defined benefit pension plan (depending on the position and division)
• May be eligible for restricted stock units (depending on the position and division)
• May be eligible for a deferred compensation plan (depending on the position and division)

Additional information

• Location: Raleigh, NC (onsite)
• Work shift: 1st shift (United States of America)
• Employment type: Regular

Preferred qualifications

• Advanced cybersecurity certification such as CISSP, CSSLP, GIAC, GWAPT, OSWE, or an equivalent application security credential
• Deep hands-on experience with enterprise DAST technologies and methodologies for complex web applications and APIs
• Advanced experience with authenticated testing, modern authentication protocols, session management, multifactor authentication, scripted login workflows, and credential handling
• Deep working knowledge of HTTP, browser behavior, web and API architectures, authentication and authorization patterns, API specifications, and common application frameworks
• Experience with security automation, APIs, scripting, data transformation, orchestration, CI/CD integrations, or workflow technologies
• Familiarity with emerging cybersecurity technologies, industry trends, and strategic risk management