Application Security Engineer

Description

The Office of Technology and Innovation runs city technology across New York City, from broadband access to cybersecurity and digital government services.

Cyber Command protects all city systems against cyber threats, including systems that deliver vital services to residents, and supports more than 100 agencies and offices across the full cycle from protection to recovery.

In this role you will help secure the city's digital infrastructure by finding, analyzing, and reducing security risks in software applications. You will carry out key parts of the Software Security Assurance Program (SSAP), using SAST, DAST, and SCA methods, performing manual application security reviews and threat modeling, and working directly with agency developers on code-level fixes.

Responsibilities

• Assess web applications, APIs, and mobile systems within the SSAP to confirm they meet city security standards before deployment.
• Run SAST, DAST, and manual security reviews to confirm vulnerabilities, remove false positives, and rank findings by operational risk.
• Operate SCA tools to track open-source and third-party component vulnerabilities and push for their remediation.
• Run structured threat modeling and logic reviews on assigned applications during design, so flaws are found before code is written.
• Act as the technical contact for agency development teams, giving clear, practical fix guidance and secure coding advice.
• Help set up and connect automated security scans in agency CI/CD pipelines such as GitHub Actions, Azure DevOps, or GitLab, supporting DevSecOps practices.
• Review third-party vendor solutions and web APIs (OAuth, REST) against city security policies and industry best practices.
• Help maintain secure coding guidelines, application security documentation, and training materials for agency developers.
• Work shifts that may include weekends and nights or evenings, as the 24/7 operation requires.

Requirements

• A bachelor's degree from an accredited college and four years of satisfactory full-time experience related to the projects and policies of the position.
• Or equivalent education and/or experience to the above.

Conditions

Based in Brooklyn, NY.

Shifts may include weekends and nights or evenings.

Candidates with other civil service titles who meet the preferred requirements should also submit a resume.

Apply through the city jobs site at searching for Job ID 791073.

Submitting a resume does not guarantee an interview.

Appointments are subject to oversight approval.

Equal opportunity employer committed to a workforce free from discrimination and harassment.