Application Security Engineer

Description

The role supports and grows the global Application Security and DevSecOps capabilities of a large clinical research and healthcare intelligence company. The team is strengthening DevSecOps, building AI security governance, and moving security earlier into software development across cloud-native platforms, containerized workloads, third-party SaaS, and AI-enabled systems.

The company wants a hands-on practitioner who works at the crossroads of engineering and security architecture and who builds, automates, and drives secure-by-design practice across global delivery teams rather than only assessing and advising.

You sit in the global Information Security organization and work with Security Architecture, Cloud Security, Vulnerability Management, and DevOps platform teams, as well as product engineering and delivery teams across business units and regions.

Responsibilities

• Own and drive adoption of CI/CD security controls with product engineering teams, covering tool configuration, findings triage, pipeline onboarding, and making sure remediation gets finished.
• Give ongoing help with CI/CD security requests, such as pipeline tooling, configuration problems, remediation, and onboarding to DevSecOps services.
• Take part in application security assessments and security design reviews, helping delivery and architecture teams find risks, agree mitigations, and track fixes.
• Serve as a security contact for development teams, advising on secure coding, SDLC requirements, and secure architecture patterns.
• Review application architectures, including cloud-native, microservices, APIs, containers, and event-driven systems, with a security-first view of design.
• Support deployments and architecture on Microsoft Azure and Amazon AWS, focusing on secure configuration, identity, network controls, and workload security.
• Help implement and run DevSecOps practices such as SAST, DAST, SCA, container scanning, secret detection, and infrastructure-as-code security.
• Build and maintain Python scripts and automations for security checks, data analysis, reporting, and CI/CD integrations where they fit.
• Support AI security for development: advise on securing AI and ML architectures, training pipelines, and LLM prompt workflows, and on managing model risk, data leakage, model abuse, and agentic system risks.
• Help write and maintain security standards, requirements, and guidance covering application security, DevSecOps, cloud development, and AI-enabled systems.
• Work with Security Architecture, Cloud Security, Vulnerability Management, and DevOps platform teams to keep work aligned with company security frameworks and toolsets.
• Track and follow up on remediation of findings from assessments and pipeline tools, making sure delivery teams resolve them.
• Promote Security by Design and shift-left thinking by getting involved early in design and development rather than enforcing security late.

Requirements

• At least 6 to 8 years of professional experience in application security, DevSecOps, software engineering, cloud engineering, or a related technical security role.
• Hands-on experience with CI/CD pipelines and DevSecOps tools, including building security checks into build and deployment workflows.
• Working knowledge of SAST, DAST, SCA, container scanning, and infrastructure-as-code security testing.
• Experience deploying and securing applications on IaaS and PaaS in Microsoft Azure and/or Amazon AWS.
• Experience with containers and modern architectures, including Kubernetes, microservices, APIs, and event-driven systems.
• Practical scripting skills, preferably in Python, for automation, integrations, or security tooling.
• Knowledge of secure software development, the OWASP Top 10, common application attack patterns, and secure coding principles.
• Foundational to intermediate understanding of AI and ML security, including agent development, model risk, data protection, pipeline security, and misuse scenarios.
• A bachelor's degree in computer science, software engineering, information security, or equivalent practical experience is preferred.
• Security or cloud certifications such as CSSLP, GWAPT, AWS or Azure security, CKAD, CKS, or equivalent are preferred but not mandatory.
• Working knowledge of frameworks and standards such as NIST, OWASP, ISO 27001, or similar is an advantage.
• Strong communication skills, with the ability to work directly with engineers and explain security concepts in a practical, delivery-focused way.

Conditions

All candidate information and credentials must be truthful and complete. Any false statements, misrepresentations, or material omissions will lead to disqualification, or dismissal if found later, in line with applicable law.

The company is committed to equal employment opportunity and to equal treatment of women and men as a matter of corporate and HR policy.