Application Security Engineer

Wolfe, LLC is seeking an on-site Application Security Engineer in Pittsburgh, PA to work closely with developers and the security team. In this role, you will help strengthen application security through vulnerability management, dependency risk reduction, secure code review, and improvements to automated security tooling in CI/CD.

You will own key parts of the security workflow, from triaging findings through remediation against defined SLAs, while also supporting offensive security efforts such as red team exercises and penetration testing under guidance.

What You’ll Do

• Run the vulnerability management program day-to-day by triaging, prioritizing, routing, and tracking findings from Dependabot, SCA, SAST, DAST, and container scans through remediation against defined SLAs.
• Own dependency and open-source risk by managing Dependabot alerts and pull requests across repositories, partnering with developers to upgrade, patch, or mitigate vulnerable libraries without breaking builds.
• Support the Head of Offensive Security in red team exercises and penetration tests, including reconnaissance and hands-on testing under guidance, and produce write-ups with clear reproduction steps and fixes.
• Conduct code reviews and collaborate directly in developers’ repositories and CI/CD pipelines (including GitHub or AWS) to identify and remediate vulnerabilities early across application code, containers, and infrastructure as code.
• Integrate and improve automated security tooling (such as Snyk, Semgrep, Dependabot, or Cycode) in CI/CD and automate findings triage and reporting.
• Apply and promote secure coding standards aligned to OWASP and the SANS CWE Top 25, and contribute to measuring DevSecOps maturity using frameworks such as DSOMM or BSIMM.

Requirements

• 4-5 years of experience in software development and security engineering, including hands-on coding experience.
• Experience reviewing and fixing code in one or more languages, with comfort working directly in developers’ repositories.
• Hands-on experience with vulnerability and dependency management, including Dependabot, SCA, and tracking findings to remediation against SLAs.
• Working familiarity with offensive security concepts and tooling such as penetration testing, OWASP Top 10, and SANS CWE Top 25, with eagerness to grow red-team skills hands-on with support to earn certifications.
• Familiarity with CI/CD pipelines (GitHub or AWS), infrastructure as code (Terraform/Ansible), and containerized services on AWS.
• Ability and willingness to work five days onsite in Pittsburgh and collaborate closely with developers and the security team.

Technologies

• Dependabot, SCA, SAST, DAST, Snyk, Semgrep, Cycode
• OWASP, OWASP Top 10, SANS CWE Top 25
• DSOMM, BSIMM
• GitHub, AWS, Terraform, Ansible

Impact

• Clear the backlog of open Dependabot and dependency vulnerabilities to SLA across priority repositories, partnering with developers to merge or mitigate fixes, with weekly reporting on open findings and remediation KPIs.
• Integrate or meaningfully improve at least one automated security tool (SCA/Dependabot, SAST, DAST, or container scanning) in the production CI/CD pipeline, supporting a documented triage-to-remediation workflow.
• Participate hands-on in at least one red team or penetration-test engagement alongside the Head of Offensive Security, delivering documented findings with reproduction steps and remediation guidance.
• Establish a working cadence with development teams by embedding in two dev pods’ review and release processes so security findings are triaged and fixed as part of normal delivery.

Compensation and Benefits

Pay: $120,000.00 - $130,000.00 per year

• Restricted Stock Units (RSUs)
• Profit Share
• Medical, Prescription, Vision, and Dental insurance for employees and dependents (Wolfe pays 80% of premium)
• Short-Term Disability Insurance (Wolfe pays 100% of premium)
• Voluntary Long-Term Disability Insurance, Life Insurance, Critical Illness Insurance, Accident Insurance, and Hospital Indemnity coverage
• PTO (vacation and sick time)
• Corporate Holidays and Floating Holidays
• 401(k)
• Employee recognition program
• Charitable Donation to a charity of your choice yearly
• Employee Referral Bonus
• Tuition Reimbursement
• Internal Training and Information sessions
• Family Picnic, Holiday Party, and other outings
• Internal Culture Club