Security Engineer (Application Security)

Blue Cross Blue Shield Association is seeking a Security Engineer focused on application security to strengthen secure engineering practices across a broad set of cloud-native and software delivery environments. In this hybrid role based in Chicago, you will apply security engineering and assessment approaches spanning web, API, containerized, and microservices-based applications, while partnering with architects and stakeholders to support roadmaps, risk management, and incident response readiness within the application security domain.

Role overview

The Security Engineer (Application Security) will apply application security engineering, assessment, and secure software development practices across cloud-native applications and DevSecOps pipelines. You will help integrate security controls and testing throughout the software development lifecycle, support the application vulnerability assessment lifecycle, and contribute to operational excellence, risk visibility, and remediation outcomes.

Responsibilities

• Partner with architects and key stakeholders to interpret engineering and operational guidance within a security domain or program and contribute across multiple related projects.
• Lead development of comprehensive roadmaps for multiple projects or departments.
• Drive operational excellence through process improvement initiatives, including designing and executing improvements.
• Identify and implement strategic savings opportunities to support significant cost optimization efforts.
• Improve security risk visibility by developing and overseeing robust risk management frameworks.
• Support domain incident response efforts as needed, maintain the defined security architecture, and manage domain-specific security tools.
• Apply application security engineering, assessment, and secure software development practices across cloud-native, web, API, containerized, and microservices-based applications.
• Support the application vulnerability assessment lifecycle and integrate security controls and testing throughout the software development lifecycle and DevSecOps pipelines.

Key requirements

• Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent work experience.
• 5+ years of cybersecurity experience with a preferred focus on application security, vulnerability assessments, and secure software development practices.
• Experience implementing risk remediation prioritization, including collaboration with stakeholders to understand risk drivers and remediation blockers.
• Experience monitoring and tracking remediation efforts, staying current on emerging threats, and leading the design, implementation, and maintenance of domain-specific toolsets.
• Experience conducting SAST, DAST, SCA, SBOM analysis, API security assessments, secure code reviews, threat modeling, and risk assessments.
• Experience managing the Application Vulnerability Assessment (AVA) cycle, including planning, validation and rating, reporting, remediation guidance and tracking, and validation of fixes.
• Experience assessing cloud-native, web, API, containerized, and microservices-based applications across Azure, AWS, Kubernetes, and OpenShift.
• Experience working with internal and external auditors and Governance, Risk, and Compliance (GRC) teams to provide assessment evidence, address findings, and support compliance activities.
• Experience with Infrastructure as Code technologies, including Terraform, Bicep, ARM Templates, YAML, Docker, Kubernetes manifests, and Helm, plus the ability to develop automation and security testing scripts.
• Ability to plan, develop, implement, and update the company’s information security strategy.
• Excellent communication and presentation skills for both technical and non-technical audiences.
• Advanced analytical and problem-solving skills with the ability to manage multiple projects while ensuring timely and budget-friendly completion.
• Strong interpersonal skills with the ability to influence and solve problems effectively.
• Solid understanding of HIPAA/HITRUST requirements, cloud-first security practices, and various security tools and technologies.
• Advanced knowledge of application security principles and standards, including OWASP Top 10, OWASP API Security Top 10, OWASP ASVS, NIST Cybersecurity Framework, HIPAA, HITRUST, FedRAMP, FISMA, FIPS, and AICPA SOC reporting requirements.
• Proficiency with application security testing and assessment tools such as Burp Suite, OWASP ZAP, Checkmarx, Veracode, Fortify, GitHub Advanced Security, SonarQube, Postman, and SoapUI.
• Knowledge of software supply chain, cloud, container, and vulnerability management security tools, including Snyk, Mend/WhiteSource, Black Duck, Dependabot, JFrog Xray, Cortex Cloud, Prisma Cloud, Tenable Cloud Security, Wiz, Aqua Security, Trivy, Microsoft Defender for Cloud, Tenable Vulnerability Management, Brinqa, and ServiceNow Vulnerability Response.
• Knowledge of DevSecOps platforms and practices, including GitHub Enterprise, GitHub Actions, Azure DevOps, Jenkins, secure software testing, and test-driven development (TDD).
• Ability to review and assess code in Python, Java, JavaScript, TypeScript, Node.js, AngularJS, C#, PowerShell, Go, SQL, Bash, and other commonly used shell scripting languages.
• Ability to identify and assess vulnerabilities including authentication flaws, authorization weaknesses, insecure APIs, injection attacks, secrets exposure, cloud misconfigurations, and container security risks.
• Ability to communicate technical findings to developers and translate risk, impact, and remediation guidance for business and non-technical stakeholders.
• Ability to drive continuous improvement in application security capabilities, vulnerability management processes, remediation validation, and enterprise risk visibility.
• Preferred: AI literacy and understanding of generative AI tools, including appropriate business applications and limitations.

Technologies you’ll work with

• Platforms: Azure, AWS, Kubernetes, OpenShift
• Infrastructure as Code: Terraform, Bicep, ARM Templates, YAML, Docker, Kubernetes manifests, Helm
• Application security and assessment: Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), Software Bill of Materials (SBOM), API security assessments, secure code reviews, threat modeling, risk assessments, Application Vulnerability Assessment (AVA) cycle
• Frameworks/standards: OWASP Top 10, OWASP API Security Top 10, OWASP ASVS, NIST Cybersecurity Framework, HIPAA, HITRUST, FedRAMP, FISMA, FIPS, AICPA SOC reporting requirements
• Security testing and scanning tools: Burp Suite, OWASP ZAP, Checkmarx, Veracode, Fortify, GitHub Advanced Security, SonarQube, Postman, SoapUI
• Software supply chain and vulnerability management: Snyk, Mend/WhiteSource, Black Duck, Dependabot, JFrog Xray, Cortex Cloud, Prisma Cloud, Tenable Cloud Security, Wiz, Aqua Security, Trivy, Microsoft Defender for Cloud, Tenable Vulnerability Management, Brinqa, ServiceNow Vulnerability Response
• DevSecOps: GitHub Enterprise, GitHub Actions, Azure DevOps, Jenkins, test-driven development (TDD)
• Languages: Python, Java, JavaScript, TypeScript, Node.js, AngularJS, C#, PowerShell, Go, SQL, Bash

Compensation and location

• Location: Chicago, IL (hybrid)
• Salary range: USD 118,500 - 171,825 per year

Benefits

• Paid time off
• 11 holidays
• Medical, dental, and vision insurance
• 401(k) matching
• Lifestyle spending account
• Many other benefits to eligible employees
• Annual bonus incentive pay (eligible)