DevSecOps / Application Security Engineer

DevSecOps / Application Security Engineer to support an enterprise customer with an immediate focus on vulnerability remediation, patching, and securing software development environments. This consultant will work closely with application development, infrastructure, and security teams to identify and prioritize vulnerabilities, coordinate remediation, and strengthen security controls throughout the software development lifecycle. The ideal candidate has hands-on experience with GitHub and GitLab and can quickly contribute in a fast-paced environment with urgent security and patching requirements.

Responsibilities: 

• Own application and software-development-environment remediation activities, including applying security patches where appropriate and coordinating with infrastructure or platform teams when they own patch deployment.

• This role will be primarily focused on patching. The engineer will identify and prioritize vulnerabilities, apply required application and software-development-environment patches, track patching work through completion, and validate that each fix has addressed the identified risk.

• Review GitHub and GitLab repositories, dependencies, libraries, and application components for security risks.

• Integrate and improve security controls and scanning within CI/CD pipelines.

• Partner with application development, infrastructure, and cybersecurity teams to coordinate remediation activities.

• Support static application security testing, dynamic application security testing, software composition analysis, dependency scanning, and secrets scanning.

• Help establish and reinforce secure coding and DevSecOps practices across the software development lifecycle.

• Provide technical guidance on patching, vulnerability management, application security, and risk reduction.

• Assist with response and remediation activities for critical or newly disclosed vulnerabilities.

Qualifications: 

• Hands-on experience in DevSecOps, application security, product security, or security engineering.

• Strong working experience with GitHub and GitLab in enterprise software development environments.

• Experience securing CI/CD pipelines and integrating security testing into development workflows.

• Strong understanding of vulnerability management, patching, remediation, and risk prioritization.

• Knowledge of SAST, DAST, software composition analysis, dependency scanning, secrets scanning, and secure coding practices.

• Familiarity with common application vulnerabilities and OWASP principles.

• Ability to work effectively across development, infrastructure, and cybersecurity teams.

• Ability to operate with urgency and independently drive remediation work in a fast-paced enterprise environment.

• Experience with PHP application environments and critical or zero-day vulnerability response is preferred.

• Preferred certifications include GitHub Advanced Security (GH-500), GIAC Cloud Security Automation (GCSA), GIAC Web Application Penetration Tester (GWAPT), GIAC Certified Web Application Defender (GWEB), Offensive Security Web Expert (OSWE), or comparable application security credentials.

Tools and Technologies: 

• GitHub and GitHub Advanced Security

• GitLab and GitLab security capabilities

• CI/CD pipelines and DevSecOps tooling

• SAST, DAST, software composition analysis, dependency scanning, and secrets scanning tools

• Application security platforms such as Snyk, Veracode, Checkmarx, SonarQube, Black Duck, Mend, or comparable tools

• PHP application environments

• OWASP application security standards and guidance