← All roles

Staff Application Security Engineer (R5949)

Shield AI· Enterprise Operations Division – Cybersecurity
Apply on company site
Remote$143k - $214kFull Time EmployeePosted 4w ago

About the role

Staff-level, individual-contributor role to build and advance a scalable, developer-centered application security program, establish company-wide secure SDLC policies and standards, and partner with product, platform, and development teams to improve secure development and software supply-chain maturity.

Responsibilities

  • Establish, maintain, and continuously improve company-wide secure SDLC policies, standards, control objectives, procedures, and supporting evidence requirements.
  • Translate security policy into clear, achievable requirements for development, product, and platform teams without creating unnecessary delivery friction.
  • Assess the maturity of development teams, CI/CD pipelines, source-control practices, build environments, and release processes; define and lead practical improvement roadmaps.
  • Develop secure-development guidance, reference architectures, reusable patterns, security guardrails, exception processes, and developer enablement materials.
  • Partner directly with development teams to identify, triage, prioritize, remediate, and verify application-security findings.
  • Evaluate, implement, tune, and operationalize application-security tooling (SAST, DAST, SCA, secrets detection, IaC security scanning, container/image security, API/cloud-native controls).
  • Ensure security tooling produces actionable, prioritized findings with minimal false positives.
  • Lead or facilitate threat modeling, security requirements definition, and secure design/architecture reviews for high-risk applications.
  • Establish risk-based vulnerability management processes including SLAs, compensating controls, and escalation/exception management.
  • Develop and maintain processes for identifying, tracking, and remediating vulnerable third-party/open-source/transitive dependencies.
  • Establish open-source software governance (inventory, license review, workflows, policy enforcement).
  • Mature software supply-chain security practices (SBOMs, VEX, build provenance, signing, verification, trusted promotion, secure repositories, and SLSA-aligned controls).
  • Partner with DevOps/platform engineering to secure CI/CD pipelines (least-privilege, protected branches, secret handling, hardened builds, release approvals).
  • Establish requirements for secure source-code repos, build systems, dependency registries, artifact repos, and deployment pipelines.
  • Support vulnerability intake, coordinated disclosure, customer-facing advisories, CVE triage, and product-security incident response.
  • Create and lead a security champions program with guidance, training, tools, and office hours for developers.
  • Develop executive-ready metrics on secure-SDLC adoption, AppSec risk, remediation performance, control coverage, supply-chain integrity, and program maturity.
  • Support customer, regulatory, audit, and assurance activities related to secure-development and software supply-chain practices.

Qualifications

  • 7+ years of experience in application security, product security, DevSecOps, secure software engineering, cybersecurity engineering, or related field.
  • Experience designing, implementing, or maturing a secure SDLC or application-security program across multiple engineering teams.
  • Strong knowledge of secure coding practices, application-security testing, vulnerability management, software delivery, and DevSecOps principles.
  • Experience working directly with developers to explain findings, guide remediation, and improve secure-development practices.
  • Hands-on experience with SAST, DAST, SCA, dependency vulnerability management, secrets scanning, and related tooling.
  • Experience integrating security controls into source-control, CI/CD, build, release, and deployment workflows.
  • Experience performing or facilitating threat modeling, security design reviews, architecture reviews, or security requirements definition.
  • Knowledge of common application-security risks (authentication/authorization, API security, insecure deserialization, injections, insecure dependencies, secrets exposure, business-logic vulnerabilities).
  • Experience with software supply-chain security concepts (SBOMs, dependency provenance, build integrity, artifact signing, release attestations, secure artifact management).
  • Experience with open-source software risk management (vulnerable dependencies, transitive dependencies, license obligations, governance).
  • Familiarity with NIST SP 800-218/SSDF, OWASP SAMM, SLSA, or similar frameworks.
  • Ability to read and assess production code/scripts in one or more modern languages.
  • Strong written and verbal communication, able to explain risk and tradeoffs to developers, leaders, auditors, and nontechnical stakeholders.

Skills

Required:Secure SDLC

Benefits

  • Pay within range listed + Bonus + Benefits + Equity
  • Temporary benefits package after 60 days of employment (for temporary employees)
  • Salary compensation influenced by skill set, experience, licenses, certifications, and location; background/reference checks; eligibility details vary by status
Last updated Oct 23, 2026. Interested? Apply on the company site.

About Shield AI

Autonomy for the world.

Our mission is to protect service members and civilians with intelligent systems.

AerospaceAutonomyDefenseliquid-ai-recruiting-targetsetter-30setter-30-2026-q1
Company profileWebsite

More open roles at Shield AI