Principal Engineer – Application Security, Secure Development

Role Overview

• Act as an advisor to leadership to develop or influence applications, network, information security, database, operating systems, or web technologies for highly complex business and technical needs across multiple groups
• Lead the strategy and resolution of highly complex and unique challenges requiring in-depth evaluation across multiple areas or the enterprise, delivering solutions that are long-term, large-scale and require vision, creativity, innovation, advanced analytical and inductive thinking
• Translate advanced technology experience, an in-depth knowledge of the organizations tactical and strategic business objectives, the enterprise technological environment, the organization structure, and strategic technological opportunities and requirements into technical engineering solutions
• Provide vision, direction and expertise to leadership on implementing innovative and significant business solutions
• Maintain knowledge of industry best practices and new technologies and recommends innovations that enhance operations or provide a competitive advantage to the organization
• Strategically engage with all levels of professionals and managers across the enterprise and serve as an expert advisor to leadership
• Lead and mentor a federated network of Application Security Champions (ASCs), establishing standards, playbooks, and metrics to scale secure development practices consistently across non CIO engineering teams
• Drive integration of application security controls into CI/CD pipelines and developer tooling, enabling automated detection and remediation of vulnerabilities across the software development lifecycle
• Oversee threat modeling, vulnerability assessments, and secure design reviews for complex, high risk applications and shared services, ensuring alignment with enterprise security policies and standards
• Champion secure adoption of emerging technologies, including AI/LLM-enabled applications, by defining guardrails, patterns, and risk mitigation strategies for safe enterprise use

Requirements

• 7+ years of Engineering experience, or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, education
• 7+ years Application Security Engineering Experience building AI/LLM Application Security scalable solutions for enterprise production environments
• Demonstrated deep, hands-on expertise in: Secure application architecture and design
• Secure coding practices and code-level vulnerability analysis
• Threat modeling and abuse case analysis
• Authentication, authorization, session management, API security, and secrets management
• Common application vulnerabilities and exploit patterns (e.g., OWASP Top 10, deserialization, injection, SSRF, access control issues, insecure design, dependency risk)
• Strong hands-on experience securing applications built in one or more modern technology stacks such as Java, .NET, Python, JavaScript/TypeScript, Node.js, Go , or similar.
• Experience integrating security into CI/CD pipelines , developer workflows, and engineering platforms.
• Experience with one or more of the following: SAST, SCA, DAST, IaC scanning, container security, API security testing, code review, threat modeling, runtime protection , or software supply chain security controls.
• Hands-on experience with AI security , including securing AI-enabled applications or advising engineering teams on the secure use of AI/LLM-based capabilities.
• Ability to independently investigate complex technical problems, identify root causes, and drive practical remediation.
• Strong written and verbal communication skills with the ability to influence both engineers and senior stakeholders.
• Proven ability to operate both strategically and tactically—moving from enterprise patterns to code-level detail as needed.
• Prior experience serving as an Application Security Champion , Security Champion, embedded security lead, or senior engineer responsible for driving security within product/application teams.
• Experience designing security controls for cloud-native and distributed systems running in Azure, AWS, or GCP .
• Experience with software supply chain security , including dependency risk management, build pipeline hardening, SBOM, artifact integrity, provenance, and package governance.
• Experience with runtime application protection , threat detection, or exploit prevention technologies.
• Familiarity with Zero Trust , secure platform engineering, and policy-as-code approaches.
• Experience defining standards, playbooks, or secure reference architectures that can be adopted broadly by engineering organizations.
• Background in software engineering or architecture prior to moving into security.
• Certifications: CSSLP, GIAC GWEB, CISSP, GIAC GWAPT, CCSP, CCSP.

Tech Stack

• AWS
• Azure
• Cloud
• Distributed Systems
• Google Cloud Platform
• Java
• JavaScript
• Node.js
• Python
• TypeScript
• Go
• .NET

Benefits

• Ability to travel up to 10% of the time
• Ability to work a hybrid schedule – 3 days per week on-site/in office and 2 days per week remote