Haystack
← Back to Jobs
Technology
HD

Application Security Engineer

Hudson Data LLCAlbany, NY🇺🇸United StatesPosted Oct 12, 2026

Quick Overview

Seniority
Mid Senior
Work mode
Hybrid
Location
Albany, NY, United States
Posted
17 hours ago
OWASPSonarQubeHIPAAJava

Job Description

• The Application Security Engineer is responsible for integrating security into the design, development, testing, and delivery of large-scale Java applications. This role is focused on secure software engineering, application security analysis, vulnerability remediation, and strengthening security practices throughout the SDLC.
• The successful candidate should bring prior Java development or architecture experience and be able to work directly with Development and Testing teams on secure coding, code and architecture review, SAST/DAST findings, remediation, and security integration within CI/CD.
    
MINIMUM QUALIFICATIONS
• Bachelor's degree in Computer Science, Information Security, Software Engineering, or a related technical field.
• 6+ years of combined software Development and/or Application Security experience.
• Prior hands-on Java/J2EE development or architecture experience.
• Experience supporting security for large-scale, public-facing enterprise applications.
• Experience working directly with Development teams to analyze and remediate application vulnerabilities.
    
REQUIRED TECHNICAL / FUNCTIONAL SKILLS
• Strong Core Java/J2EE development knowledge and ability to understand application code, frameworks, and architecture.
• Application security analysis including secure code review, pull-request review, and/or architecture/design review.
• Secure coding practices and common web application vulnerabilities, including OWASP risks.
• Hands-on experience analyzing SAST/DAST findings; familiarity with tools such as Fortify on Demand and SonarQube.
• Ability to determine whether security-tool findings are relevant, exploitable, false positives, or require remediation.
• Experience integrating application security activities into CI/CD and the software development lifecycle.
• Experience partnering with Development and Testing teams on remediation, validation, and security testing.
• Understanding of authentication, authorization, session management, APIs, cryptography, and SSL/TLS.
• Ability to clearly document risk, technical findings, remediation guidance, and validation results.
    
KEY RESPONSIBILITIES
• Review Java application code, design, and architecture for security weaknesses and recommend corrective action.
• Analyze SAST, DAST, and other application-security findings and work with Development teams to prioritize and remediate issues.
• Provide secure coding guidance and practical remediation recommendations to developers.
• Partner with Development and Testing teams to integrate security checks and validation into delivery pipelines and test practices.
• Validate remediation and help distinguish true vulnerabilities from false positives or non-exploitable findings.
• Support secure SDLC practices, application security standards, and continuous improvement activities.
• Review application changes, APIs, authentication/authorization patterns, and other security-sensitive functionality.
• Monitor relevant Java vulnerabilities, third-party component risks, and published NIST CVEs.
• Document findings, risk, remediation guidance, and validation results for technical and non-technical stakeholders.
    
PREFERRED QUALIFICATIONS
• Fortify on Demand, SonarQube, or comparable SAST/DAST tooling.
• Software Composition Analysis (SCA) and Software Bill of Materials (SBOM) experience.
• API security testing and secure design review.
• Cloud application security experience.
• Relevant application-security certification.
• HIPAA or other regulated-environment experience.
• AI-assisted application-security tools, with manual validation of findings.
    
CANDIDATE PROFILE
• Candidate should clearly explain a current/recent Java application and their individual Application Security responsibilities.
• Candidate should provide specific examples of code, architecture, SAST/DAST, or secure-design findings they personally analyzed.
• Candidate should explain how they determined whether a finding represented real risk and how they worked with Development on remediation.

Similar jobs

Browse related jobs

Apply on employer’s website