Application developer Jobs in Newark, NJ

Overview

The Application Security Engineer is a hands-on software security professional responsible for integrating security throughout the software development lifecycle. The role focuses on securing custom applications, APIs, dependencies, containerized workloads, and CI/CD pipelines while partnering with development, platform, cybersecurity, and risk teams. The engineer identifies, prioritizes, and remediates application-layer risks, implements scalable controls, and helps establish a durable application security operating capability that can be transferred to permanent staff.

Requires 7-10 years of experience for mid-level candidates and 10-15 years of experience for senior-level candidates. A strong combination of software engineering, application security, automation, DevSecOps, and security-program execution is required. Experience in regulated, high-availability, or business-critical environments is highly desirable.

Required Experience

Hands-on experience developing, reviewing, testing, and remediating application code in modern software environments.

Experience identifying and mitigating vulnerabilities in applications, APIs, open-source dependencies, container images, frameworks, runtimes, and software supply chains.

Strong understanding of secure software design, secure coding practices, threat modeling, and common application security risks.

Experience embedding security controls and approval criteria into source-control, pull-request, build, test, release, and deployment workflows.

Practical experience with SAST, software composition analysis, secrets detection, dependency management, container scanning, and vulnerability-management platforms.

Experience validating findings, assessing exploitability and business impact, reducing false positives, and defining risk-based remediation SLAs.

Experience securing containerized and cloud-native applications, including Docker, Kubernetes, registries, base images, and policy-as-code controls.

Strong scripting and automation experience using Python, PowerShell, Bash, or a comparable language.

Experience operating vulnerability remediation, exception and risk-acceptance processes, including compensating controls, ownership, expiration, and escalation.

Strong communication, problem-solving, and cross-functional leadership skills, with the ability to take ownership from discovery and baseline through implementation, stabilization, documentation, and knowledge transfer.

Responsibilities

Inventory and baseline in-scope applications, repositories, dependencies, container images, delivery pipelines, security-tool coverage, and end-of-life frameworks and runtimes; identify unmanaged or unscanned assets.

Partner with development teams to identify, prioritize, and remediate vulnerabilities in code, APIs, dependencies, container images, and application configurations.

Perform secure code reviews, architecture and design reviews, and application security assessments throughout the software development lifecycle.

Write, review, test, and submit application-code and pipeline-configuration changes required to resolve security issues.

Define, implement, and maintain risk-based security gates, approval criteria, automated controls, and controlled bypass processes across source-control and CI/CD workflows.

Configure and tune application security tooling to improve coverage, accuracy, maintainability, developer usability, and false-positive rates; recommend whether tools should be retained or retired.

Establish secure development standards, remediation SLAs, finding-routing rules, and an application-security exception register with compensating controls, owners, expiration dates, and escalation paths.

Develop automation for repository and pipeline coverage monitoring, finding intake, triage, ownership assignment, overdue remediation, failed gates, expired exceptions, reporting, and escalation.

Support container and Kubernetes security through dependency and base-image currency practices, image governance, workload controls, and policy-as-code enforcement.

Define, track, and report application security KPIs, including scanner coverage, remediation performance, gate effectiveness, backlog and exception aging, and end-of-life technology risk; create runbooks, operating documentation, training, and knowledge transfer materials.

Qualifications

Strong software development skills in one or more modern programming languages; C# and .NET experience is highly desirable.

Deep understanding of application architecture, web applications, APIs, microservices, authentication, authorization, secrets management, and secure coding principles.

Experience with Git, GitHub, Jenkins, GitOps workflows, and modern CI/CD platforms; familiarity with Flux is desirable.

Experience with tools such as Aikido, SonarQube, Gitleaks, Trivy, Renovate, or equivalent application security technologies.

Experience with Docker, Kubernetes, container registries, and policy-as-code frameworks such as Kyverno.

Understanding of software supply-chain security, dependency and base-image lifecycle management, artifact integrity, and end-of-life technology risk.

Ability to perform root-cause analysis and establish ownership across code, dependencies, containers, pipelines, platforms, and infrastructure boundaries.

Ability to translate technical risk into prioritized roadmaps, measurable controls, operational reporting, and clear communication for engineering and leadership audiences.

Familiarity with cloud application security and cloud-native delivery patterns; AWS experience is a plus.

Bachelor's degree in computer science, software engineering, cybersecurity, information systems, or equivalent professional experience; demonstrable use of AI-assisted engineering tools such as GitHub Copilot with appropriate validation and secure-development practices.