Senior Application Security Engineer / DevSecOps Engineer

About the role

A remote, fully bilingual (Spanish/English) position for a Senior Application Security Engineer / DevSecOps Engineer to support and strengthen the organization's Application Security Program. The role is hands-on, covering application security testing, vulnerability analysis and remediation, DevSecOps integration and close collaboration with application development teams. It is a 6-month contract (renewable).

Key responsibilities

• Configure, run, monitor, administer and troubleshoot application security platforms (SAST, DAST, SCA), working with vendors to resolve issues and manage support tickets.
• Analyze and manage vulnerabilities: false positives, duplicates, exploitability, prioritization, remediation, exception documentation and risk assessment.
• Give developers actionable remediation guidance and help verify fixes.
• Maintain security controls, GitLab and Jenkins CI/CD integrations, security metrics, vulnerability dashboards, weekly status reports and monthly management reports.
• Support Secure SDLC practices, work with developers to close vulnerabilities, and engage with Security Champions.
• Keep accurate vulnerability records and prepare reports for technical and business stakeholders; help automate security processes.

Required profile

• 5+ years in application security, product security, DevSecOps or a related cybersecurity discipline.
• Hands-on experience with SAST, DAST and SCA tools and integrating them into GitLab CI/CD pipelines.
• Strong understanding of vulnerability assessment, prioritization and remediation, and of DevSecOps and Secure SDLC.
• Direct experience working with software developers and engineering teams.
• Preferred: Security Champions program experience, Veracode and GitLab security pipeline experience, automation with Python, PowerShell or Bash, AWS, container security, IaC scanning, secrets detection and API security testing, and certifications such as GWAPT, GWEB, OSCP, CSSLP or Security+.

Required skills

• SAST, DAST, SCA and OWASP Top 10
• Vulnerability management and secure coding
• GitLab CI/CD and CI/CD security integration
• DevSecOps practices and security automation