Senior Application Security Engineer

AmTrust Financial Services, Inc. is seeking a Senior Application Security Engineer to join the Security Assurance team in Cleveland, OH (onsite). In this role, you will collaborate with software engineering teams to identify, assess, and reduce security risk across applications, APIs, cloud-native platforms, and AI-enabled solutions.

The position focuses on integrating security throughout the secure software development lifecycle (SSDLC), combining secure design reviews, code review, penetration testing, threat modeling, automated controls, and risk-based vulnerability management.

What You’ll Do

• Lead application security assessments, secure code reviews, penetration testing, and threat modeling to identify and mitigate application and API security risks.
• Develop and mature application security capabilities across the SSDLC through secure design reviews, automated testing, developer enablement, and scalable security controls.
• Partner with software engineering teams to integrate secure coding practices, vulnerability management, and security requirements into development and CI/CD workflows.
• Manage and optimize application security tooling, including SAST, SCA, DAST, secrets scanning, repository protections, and related secure development technologies.
• Advance secure adoption of cloud-native and AI-enabled solutions through security guidance, architecture reviews, risk assessments, and practical security standards.
• Act as a trusted advisor to technical and business stakeholders by communicating risks, remediation priorities, and security best practices.

Required Qualifications

• Bachelor’s degree in Computer Science, Information Technology, Computer Engineering, Cybersecurity, or a related field, or equivalent relevant professional experience.
• 5+ years of experience in application security, product security, DevSecOps, penetration testing, or security engineering.
• Demonstrated experience working directly with software engineering teams to integrate security into modern software development processes and delivery pipelines.
• Strong expertise in secure coding practices, source code analysis, vulnerability identification, threat modeling, and application security testing.
• Hands-on experience implementing and operating application security controls including SAST, DAST, SCA, secrets scanning, and CI/CD security integrations.
• Deep understanding of web application, API, and cloud-native security principles.

Tools and Technologies

• SAST, SCA, DAST, secrets scanning
• CI/CD
• Cloud-native and AI-enabled solutions
• Azure
• Containers, Kubernetes, IaC
• Software supply-chain security
• Container security, workload protection, admission controls
• Service meshes
• Tooling, Scripting
• Burp Suite
• Kubernetes security technologies

Benefits

• Medical & Dental Plans
• Life Insurance (including eligible spouses & children)
• Health Care Flexible Spending
• Dependent Care
• 401k Savings Plans
• Paid Time Off
• Life Insurance

Preferred Qualifications

• Experience securing Azure cloud and cloud-native application environments, including Azure services, containers, IaC, software supply-chain security, and CI/CD security controls.
• Hands-on experience securing AI-enabled applications, copilots, AI agents, and agentic workflows, including risks involving data exposure, trust boundaries, identity and access management, prompt manipulation, and tool invocation.
• Experience with Kubernetes and cloud-native security technologies, including container security, workload protection, admission controls, service meshes, and cloud-native security tooling.
• Experience automating and scaling security operations through scripting, security tooling, metrics, reporting, and governance in regulated or business-critical environments.
• Relevant application security, secure software development, penetration testing, or cloud security certifications, such as: CSSLP, GIAC Certified Web Application Defender (GWEB) or Web Application Penetration Tester (GWAPT), OffSec Certified Professional (OSCP) or OffSec Web Expert (OSWE), Burp Suite Certified Practitioner (BSCP), Certified Kubernetes Security Specialist (CKS).