Senior Application Security Engineer

World Wide Technology is a technology solutions company that provides cybersecurity, cloud, infrastructure, and digital services. The Senior Application Security Engineer will secure WWT-developed and WWT-operated applications by managing vulnerabilities, operating security tooling, conducting secure code reviews and threat modeling, and integrating security into the SDLC. The role also includes penetration testing, AI/LLM application security, compliance support, and mentoring engineering teams.

Responsibilities:

• Own the technical core of the application vulnerability lifecycle, driving discovery and detection, validating exploitability, prioritizing by risk, offering technical remediation guidance, and verifying fixes fully close the issue
• Cut through scanner noise by dismissing false positives with rationale and documenting clear, actionable remediation developers can act on
• Maintain playbooks that make triage, escalation, and remediation repeatable as we scale
• Operate and maintain application security tooling (SCA, SAST, DAST, secrets, etc.) across the SDLC
• Drive adoption of security tooling, partnering with developers to integrate into their workflows and maximize meaningful coverage
• Partner with DevOps to build security into delivery by integrating SCA, SAST, and DAST into the CI/CD pipeline
• Perform secure code reviews, threat models (STRIDE/PASTA), and design and architecture reviews for net-new and high-risk applications
• Surface validated findings where developers already work – IDE, pull request, ticketing – to minimize noise and context switching
• Contribute to documentation that gives developers a clear path to shipping secure code
• Scope, execute, and coordinate penetration tests across the organization’s environment overseeing remediation and validation retests
• Perform hands-on manual testing to uncover business-logic flaws, chained exploits, and vulnerabilities that automated scanners miss
• Apply secure development practices to AI/LLM-enabled and agentic applications; assess risks like prompt injection, tool poisoning, confused-deputy, and credential exposure
• Make responsible, hands-on use of AI to work faster and more effectively, reflecting our culture as an AI-first company operating at the leading edge of the field
• Act as a credible application security escalation point for engineering and a force multiplier – an enabler, not a gatekeeper
• Produce technical evidence and control mappings that satisfy compliance and audit needs across CMMC, SOC 2, ISO 27001, and NIST 800-171/800-53

Requirements:

• Bachelor's degree in Computer Science, Software Engineering, Information Security, or a related field — or equivalent hands-on experience
• Minimum 8 years of experience in roles related to application security, information security, software engineering, SecDevOps
• A demonstrable track record of independently owning AppSec domains and delivering remediation without close supervision
• Hands-on experience operating application security scanning tooling (SAST, SCA, secrets, IaC) and integrating it into CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins, Azure DevOps, or equivalent)
• Experience securing cloud-native and container/Kubernetes-based applications (AWS, Azure, GCP; Docker, Kubernetes, OpenShift)
• Ability to read and reason about code in one or more modern stacks (Java, JavaScript/TypeScript, Python, Go, or C#) well enough to perform and review secure code, trace data flows, and identify vulnerabilities in source code
• Scripting and automation in Python, Bash, or PowerShell
• Design-level understanding of authentication, authorization, and identity — session management, SSO and federation, and OAuth2/OIDC as architectural patterns
• Working knowledge of applied cryptography — TLS, certificates and PKI, secrets and key management, hashing versus encryption
• Strong command of HTTP and web API internals — request/response semantics, auth flows (OAuth2/OIDC, JWT, session management), and the authZ failures, injection, and business-logic flaws common to REST and GraphQL APIs
• Solid understanding of the secure software development lifecycle and where security testing, gates, and controls fit within it
• Strong working knowledge of OWASP ASVS, OWASP Top 10, OWASP API Security Top 10, MITRE ATT&CK, and CWE
• Working knowledge of NIST SSDF (SP 800-218), NIST 800-53, NIST 800-171, ISO 27001, SOC 2, and CMMC as they apply to secure software development
• Hands-on threat modeling experience (STRIDE, PASTA, or equivalent)
• Excellent interpersonal, written, and verbal communication — able to explain and document security risk and remediation credibly to both engineers and non-technical stakeholders
• Self-starter, team player, and enthusiasm for learning
• Applicants must be authorized to work in the United States without sponsorship. We are unable to provide sponsorship now or in the future for this position
• Direct, hands-on experience with one or more leading application security platforms (e.g., Wiz, Snyk, Apiiro, OX Security, Cycode, Checkmarx, Veracode, or GitHub Advanced Security)
• Hands-on experience securing AI/LLM-enabled and agentic applications; familiarity with OWASP Top 10 for LLM Applications, OWASP Top 10 for Agentic AI, MITRE ATLAS, NIST AI RMF, and Model Context Protocol (MCP) security implications
• Hands-on penetration testing or offensive security experience across web, API, infrastructure, or AI systems (including prompt injection, jailbreaks, and agent abuse)
• Industry certifications such as CISSP, CSSLP, GWAPT, GWEB, OSCP, OSWE, or AWS/Azure/GCP security certifications