Application Security Engineer

Join Strive as an Application Security Engineer, where you will embed application security into the product development lifecycle. You will serve as the primary security partner for Product and Engineering, ensuring secure application development from design to production. Your responsibilities will include threat modeling, architecture reviews, security testing, vulnerability management, and compliance documentation. Enjoy a range of benefits, including health insurance, flexible work arrangements, paid time off, retirement planning, and professional development opportunities.

• Embedding application security into the product development lifecycle, supporting the deployment of patient-facing experiences and mobile applications.
• Serving as the primary security partner for Product and Engineering, ensuring applications are built securely from design to production.
• Performing threat modeling, establishing security baselines, and collaborating with engineering teams to embed security acceptance criteria.

• Ability to travel and be onsite to meet business needs
• Bachelor’s degree in Computer Science, Information Security, or a related field
• Experience leading or performing application threat modeling, architecture reviews, and manual security testing
• Demonstrable experience integrating security tools into CI/CD pipelines (e.g., SAST, DAST, SCA)
• Familiarity with securing cloud environments (SaaS, IaaS, PaaS) and understanding of cloud architecture
• 3+ years (Engineer) to 5+ years (Senior) of experience in information security, with a strong focus on Application Security, DevSecOps, or software engineering
• Internet Connectivity - Min Speeds: 3.8Mbps/3.0Mbps (up/down): Latency <60 ms
• Proactive and adaptable, comfortable embedding directly with engineering pods to shift security “left”
• Strong communication and collaboration skills; capable of articulating technical risk to both technical and non-technical stakeholders
• Excellent problem-solving and analytical skills, able to assess complex application security issues and provide practical, developer-friendly solutions
• Please apply even if you feel you do not meet all qualifications
• Experience within the healthcare sector, securing environments that manage PHI and complying with frameworks like HITRUST
• Deep expertise in identifying and exploiting vulnerabilities (OWASP Top 10, IDOR, SSRF, authentication bypass)
• Experience with testing and securing complex API integrations, mobile application releases, and web-based portals
• Familiarity with enterprise dynamic testing tools (e.g., Burp Suite Enterprise) and automating security testing against deployed applications
• Advanced certifications in application security or information security (e.g., CSSLP, GWAPT, CISSP, CEH)