Staff Application Security Engineer

🔥 26 minutes ago

🇺🇸 United States – Remote

⏰ Full Time

🔴 Lead

💻 Application Engineer

👻 Ghost score 12%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Shield AI

WebsiteLinkedInAll Job Openings

501 - 1000 employees

Founded 2015

🤖 Artificial Intelligence

🚀 Aerospace

🎖️ Defense

Artificial Intelligence • Aerospace • Defense

Shield AI is a leading developer of AI-driven military solutions, focusing on enhancing mission autonomy and battlefield awareness. Their platform, Hivemind, enables rapid deployment of intelligent systems for various defense applications, including drone operation and surveillance. With a commitment to utilizing advanced technology, Shield AI aims to protect service members and civilians by revolutionizing defense technologies through autonomous systems.

📋 Description

• Establish, maintain, and continuously improve company-wide secure SDLC policies, standards, control objectives, procedures, and evidence requirements • Translate security policy into achievable requirements for development, product, and platform teams • Assess development teams, CI/CD pipelines, source-control practices, build environments, and release processes; define improvement roadmaps • Develop secure-development guidance, reference architectures, reusable patterns, security guardrails, exception processes, and developer enablement materials • Partner with development teams to identify, triage, prioritize, remediate, and verify application-security findings • Evaluate, implement, tune, and operationalize SAST, DAST, SCA, secrets detection, infrastructure-as-code scanning, container and image scanning, API, and cloud-native security controls • Lead or facilitate threat modeling, security requirements definition, and secure design or architecture reviews • Establish risk-based vulnerability-management processes, remediation objectives, compensating controls, risk acceptance, escalation, and exception management • Manage vulnerable third-party, open-source, and transitive dependencies • Establish open-source software governance, including component inventory, license identification, review, approvals, and enforcement • Mature software supply-chain security through SBOMs, VEX or equivalent communications, build and release provenance, artifact signing and verification, trusted promotion, secure repositories, package integrity, and SLSA-aligned controls • Partner with DevOps and platform engineering to secure CI/CD pipelines, source-code repositories, build systems, dependency registries, artifact repositories, and deployment pipelines • Support vulnerability intake, coordinated disclosure, customer-facing security advisories, CVE triage, and product-security incident response • Create and lead a security champions program with secure-coding guidance, training, office hours, tools, and security engagement pathways • Develop executive-ready metrics and reporting on secure-SDLC adoption, AppSec risk, remediation, control coverage, supply-chain integrity, and program maturity • Support customer, regulatory, audit, and assurance activities • Work as a Staff-level individual contributor influencing engineering, security, product, and technology leadership

🎯 Requirements

• 7+ years of experience in application security, product security, DevSecOps, secure software engineering, cybersecurity engineering, or a closely related field • Experience designing, implementing, or maturing a secure SDLC or application-security program across multiple engineering teams • Strong working knowledge of secure coding practices, application-security testing, vulnerability management, software delivery, and DevSecOps principles • Experience working directly with developers to explain findings, guide remediation, and improve secure-development practices • Hands-on experience with SAST, DAST, SCA, dependency vulnerability management, secrets scanning, and related application-security tooling • Experience integrating security controls into source-control, CI/CD, build, release, and deployment workflows • Experience performing or facilitating threat modeling, security design review, architecture review, or security requirements definition • Knowledge of authentication, authorization, API security, insecure deserialization, injection vulnerabilities, insecure dependency use, secrets exposure, and business-logic vulnerabilities • Experience with SBOMs, dependency provenance, build integrity, artifact signing, release attestations, and secure artifact management • Experience with open-source software risk management, vulnerable dependencies, transitive dependencies, license obligations, and governance processes • Familiarity with NIST SP 800-218 / SSDF, OWASP SAMM, SLSA, or comparable frameworks • Ability to read and assess production code and scripts in one or more modern programming languages • Strong written and verbal communication skills • Preferred: experience with SLSA, VEX, CSAF, SPDX, CycloneDX, cloud-native applications, containers, Kubernetes, APIs, microservices, infrastructure-as-code, source-control, CI/CD, cloud, artifact-management, package-management, container-registry platforms, listed AppSec tools, regulated-environment requirements, high-assurance environments, and relevant certifications • All offers contingent on a cleared background and possible reference check • U.S. work authorization and export-control eligibility questions are part of the application process

🏖️ Benefits

• Bonus • Benefits • Equity • Temporary benefits package applicable after 60 days of employment for temporary employees • Potential support for customer, regulatory, audit, and assurance activities

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume