Senior Application Security Engineer

J2B Global LLC is hiring a Senior Application Security Engineer on a contract basis in San Jose, CA with an onsite schedule for 5 days a week. This role is hands-on and focused on finding, reproducing, and validating application security issues across distributed systems and microservices, from early analysis through patch verification.

With 8+ years of experience, you will build practical security tooling and testing frameworks, perform deep source code reviews, and partner with engineers and code owners to drive remediation into production-ready outcomes.

Responsibilities

• Develop security tools, testing utilities, vulnerability reproduction scripts, and automated validation frameworks using Java, C++, or Python.
• Assess application architecture, including trust boundaries, data flows, attack surfaces, and security weaknesses across distributed systems and microservices.
• Investigate security scanner results, reproduce vulnerabilities, create Proofs of Concept (PoCs), and separate true security issues from false positives.
• Conduct detailed source code reviews to uncover security flaws, insecure coding practices, potential exploits, and software regressions.
• Review, test, and validate security patches, including AI-generated and automated code fixes.
• Build test harnesses and execute unit, regression, and security tests to confirm remediation effectiveness.
• Use threat modeling methodologies to identify architectural risks and recommend secure design and implementation practices.
• Evaluate vulnerabilities using CVE, CWE, OWASP Top 10, severity classifications, and security remediation SLAs.
• Collaborate with software engineers, architects, and code owners to implement security fixes and support production deployment.
• Track vulnerabilities across their lifecycle and contribute to continuous improvements in secure software development.

Requirements

• 8+ years of experience in software engineering, security software development, application security, or security engineering.
• Strong hands-on programming and debugging experience in at least one of Java, C++, or Python.
• Experience with multiple programming languages is preferred.
• Extensive ability in software development, code analysis, troubleshooting, and resolving complex technical issues.
• Strong understanding of application security, secure coding standards, vulnerability identification, and remediation approaches.
• Proven ability to reproduce vulnerabilities and validate fixes through coding, testing, and debugging.
• Proficiency in source code reviews and testing practices such as unit and regression testing, including identifying security-related defects.
• Knowledge of threat modeling frameworks including STRIDE and PASTA.
• Understanding of architectural trust boundaries, attack surfaces, data flows, and threat analysis.
• Familiarity with CVE, CWE, OWASP Top 10, vulnerability severity assessment, and security remediation SLAs.
• Experience building security test harnesses, test environments, or PoCs for vulnerability validation.
• Ability to assess automated code changes and identify security issues, functional regressions, and implementation weaknesses.

Technologies

• Java, C++, Python
• STRIDE, PASTA
• CVE, CWE, OWASP Top 10
• SAST/DAST tools
• PoCs, AI-generated code