Senior Application Security Engineer

Job not on LinkedIn

🔥 13 hours ago

🇺🇸 United States – Remote

⏰ Full Time

🟠 Senior

💻 Application Engineer

👻 Ghost score 10%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.Why this score:

• Open for 1 day.
• Jobs at this company usually fill in 43 days.
• No salary listed.

Apply Now

Check your resume score

Customize resume + cover letter

Find Similar Remote Jobs

☆ Save☑️ Mark as applied❌ Hide

Report problem

TrueCommerce

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

📦 Logistics

💼 Consulting

🏭 Manufacturing

Logistics • Consulting • Manufacturing

TrueCommerce is a global cloud-based supply chain integration platform that connects businesses with trading partners to automate EDI, ERP integrations, marketplaces, and B2B eCommerce processes. The company provides managed EDI services, vendor-managed inventory (VMI), supplier enablement, API and marketplace integrations, and pre-built connectors for major ERP systems to streamline order-to-cash, procurement, and fulfillment workflows. TrueCommerce focuses on reducing manual processes, ensuring compliance with trading partners, and providing real-time visibility across procurement and fulfillment for B2B and enterprise customers.

📋 Description

• Operate the application security program for customer-facing B2B products, embedding security by design into planning, development, and release • Implement and operate automated SAST, DAST, and SCA testing within CI/CD pipelines • Configure and maintain AppSec tooling and the vulnerability management platform • Ensure findings are consistently collected, deduplicated, and tracked across products and repositories • Prioritize vulnerabilities based on severity, known exploitation, reachability, and business impact • Drive remediation with Engineering and TechOps to agreed timelines • Perform security architecture and design reviews and threat modeling for new products and features, including the API program • Automate and orchestrate AppSec workflows using Anthropic Claude API, OpenAI, or equivalent LLM providers, with validation and guardrails • Assess AI-enabled product features and workflows for prompt injection, data leakage, and model misuse • Develop and maintain secure coding standards and technical guidance • Support data protection through encryption, secrets management, and retirement of weak ciphers and legacy protocols • Track product security risks, exceptions, and risk acceptances and contribute to the Infosec risk register and assessments • Contribute to incident response for product security events and participate in incident simulation exercises • Build and report AppSec metrics for Infosec KPIs, KRIs, and executive reporting • Provide technical evidence for audits, customer security assessments, and compliance obligations • Coach developers and deliver secure development guidance • Stay current on emerging threats, application security practices, and AI-related security and privacy concerns

🎯 Requirements

• 5+ years in application and/or product security • Hands-on experience implementing and operating SAST, DAST, and SCA tools within CI/CD pipelines • Experience triaging and prioritizing vulnerabilities using severity, known exploitation, reachability, and business impact, and driving them to remediation • Ability to review code and advise on remediation in .NET/C# • Experience performing threat modeling and security architecture and design reviews • Working knowledge of secure API design, OAuth/OIDC and JWT handling, secrets management, and encryption fundamentals • Strong working knowledge of OWASP Top 10s, ASVS, and Proactive Controls, and ability to translate findings into business risk • Scripting or programming ability (e.g., Python, PowerShell, C#) to automate security workflows and integrate tools via APIs • Clear communication with technical and non-technical audiences, and ability to influence engineering teams without direct authority • Experience using LLM APIs such as Claude or Copilot to automate AppSec work (preferred) • Experience assessing AI-enabled features for prompt injection, data leakage, and model misuse (preferred) • Experience with Azure DevOps, DefectDojo, and common open source security scanners (preferred) • Experience securing Azure-hosted environments, including IaC, containers, and secrets scanning (preferred) • Working knowledge of C++ and Angular (preferred) • Manual web and API penetration testing experience, especially for access control and multi-tenant isolation (preferred) • Experience in B2B SaaS, multi-tenant platforms, or supply chain/EDI environments (preferred) • Experience supporting security incident response (preferred) • Experience providing evidence for audits such as SOC 2, ISO 27001, and PCI and customer security assessments (preferred) • Relevant certifications such as OSWE, GWEB, CSSLP, or AZ-500 (preferred) • Applicants must be authorized to work for any employer in the U.S. • TrueCommerce is unable to sponsor or take over sponsorship of an employment visa for this role

🏖️ Benefits

• Competitive benefits • Generous paid time off packages • Flexible and casual work environments • Career development • Recognition programs • 401k with 3.5% company match and vested after 2 years • 20 PTO days • 10 company holidays • 1 birthday day off • 1 Volunteer day • 3 summer days • Medical, dental, vision and other life/health insurance plans • Paid parental leave • Wellness reimbursement program • Remote first and casual work environment

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume