Application Security Engineer

🔥 16 hours ago

🇮🇳 India – Remote

⏰ Full Time

🟡 Mid-level

🟠 Senior

💻 Application Engineer

👻 Ghost score 10%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

S&P Global

WebsiteLinkedInAll Job Openings

10,000+ employees

Founded 1860

💼 Consulting

📦 Logistics

📣 Marketing

Consulting • Logistics • Marketing

S&P Global is a leading provider of market intelligence, ratings, analytics, and benchmark indices. The company offers comprehensive insights across various domains including finance, commodities, mobility, and sustainability. Renowned for its data-driven solutions, S&P Global assists organizations in navigating complex market trends, evaluating credit risk, and understanding the implications of artificial intelligence and energy transitions. Its diverse offerings, such as S&P Global Market Intelligence, S&P Global Ratings, and S&P Dow Jones Indices, provide critical data and analytics to businesses, government entities, and investors worldwide.

📋 Description

• Implement, configure, administer and optimise enterprise SAST capabilities • Onboard applications and repositories using repeatable, documented patterns • Configure scanning profiles, policies, presets, exclusions and application-specific settings • Analyse findings across multiple languages and frameworks • Validate false positives, duplicate findings and vulnerability classifications through secure code review • Provide remediation guidance and secure coding examples • Investigate failed or incomplete scans, performance issues and integration problems • Improve scan quality through query tuning, configuration optimisation and operational metrics • Support tool migration, consolidation or rationalisation initiatives • Design and implement application security controls within CI/CD pipelines • Integrate SAST with source-code repositories, pull requests, build pipelines and developer workflows • Define risk-based security gates for builds, releases and production deployments • Create and maintain reusable pipeline templates and security components • Troubleshoot authentication, API, repository, build orchestration and scan execution issues • Partner with DevOps and platform engineering teams to improve reliability, scale and maintainability • Develop AppSec automation using Python, PowerShell, Bash or other suitable languages • Build integrations using REST APIs, webhooks, command-line interfaces and supported SDKs • Automate onboarding, scanning, result retrieval, triage, reporting and workflow updates • Automate finding normalisation, deduplication, enrichment, prioritisation and assignment • Integrate AppSec platforms with ticketing, reporting, source-control and collaboration systems • Implement logging, error handling, retries, monitoring and auditable execution records • Maintain automation code through version control, testing, documentation and peer review • Prioritise, validate and track vulnerabilities through remediation, retesting, risk acceptance or closure • Identify recurring vulnerability patterns and recommend systemic preventive controls • Apply cloud security governance principles to application workloads, services and delivery pipelines • Translate cloud control requirements into technical guardrails with cloud security, architecture, engineering, risk and compliance teams • Assess applications and pipelines against cloud security standards, configuration baselines and policy requirements • Support governance for cloud identities, roles, service accounts, secrets, encryption, logging and workload access controls • Support cloud control assessments, evidence collection, exception management, remediation tracking and audit readiness across AWS, Microsoft Azure and Google Cloud • Map AppSec and CI/CD controls to enterprise policies, regulatory obligations and recognised security frameworks • Embed application security requirements across design, development, testing and release processes • Support threat modelling and security reviews for high-risk applications or significant changes • Create standards, checklists, onboarding guides, runbooks and technical documentation • Deliver technical enablement for developers, DevOps engineers and security champions • Maintain programme records, coverage metrics, remediation data and audit evidence • Support control assessments, risk reviews, exception governance and continuous improvement

🎯 Requirements

• Bachelor's or Master's degree in Computer Science, Information Security, Engineering or a related discipline, or equivalent practical experience • Five or more years of relevant experience in Application Security, Product Security, DevSecOps or software security engineering • Strong hands-on experience with enterprise SAST platforms, secure code analysis and vulnerability validation • Practical experience integrating security scanning into CI/CD pipelines and source-control workflows • Experience with GitHub, GitHub Actions, Azure DevOps, Jenkins, GitLab CI or equivalent technologies • Strong scripting or development skills using Python, PowerShell, Bash, Java, C#, JavaScript or similar languages • Experience building integrations with REST APIs, webhooks, service accounts and modern authentication mechanisms • Strong understanding of OWASP Top 10, CWE classifications, secure coding and vulnerability remediation • Ability to review source code and validate findings in at least one major programming language • Understanding of web applications, APIs, microservices, containers and cloud-native architectures • Working knowledge of cloud security governance, security control implementation, compliance evidence and exception management • Understanding of cloud IAM, encryption, secrets management, logging, monitoring and secure configuration principles • Strong analytical, troubleshooting, documentation and stakeholder communication skills • Hands-on administration or integration experience with leading SAST platforms • Current or recent vendor certification focused on SAST administration, implementation, query development, scanning or secure code analysis • Knowledge of or certifications in penetration testing, application security, cloud security, DevSecOps or secure software development are preferred or beneficial • Experience integrating SCA, secrets scanning, API security, Infrastructure as Code scanning or container security is preferred • Experience developing reusable CI/CD components is preferred • Knowledge of software supply chain security, dependency risk management and cloud security is preferred • Experience producing AppSec dashboards, control evidence and programme metrics is preferred

🏖️ Benefits

• Health care coverage designed for the mind and body • Generous time off • Continuous learning resources and career development opportunities • Competitive pay • Retirement planning • Continuing education program with company-matched student loan contribution • Financial wellness programs • Family-friendly benefits and perks • Retail discounts • Referral incentive awards