Senior Application Security Specialist
cls groupWoodbridge Township (NJ)
$140,000–$180,000
Apply (opens in a new tab)Senior Application Security Specialist
Posted today
cls groupWoodbridge Township (NJ)
SENIORITY
Lead
SALARY
$140,000–$180,000
About the role
Role overview
Job title: Application Security Specialist
Department: IT Security
Level: Vice President
Reports to: Director, Application Security
Location: New Jersey
Compensation: $140,000–$180,000 base salary + variable compensation + 401(k) match + benefits
We're hiring an Application Security Specialist to help development teams build secure, resilient software. This is a hands-on AppSec role for someone who can interpret security findings, understand real-world application risk, and turn that insight into practical guidance for engineers. This is not a DevSecOps tooling integration roleengineering teams own security tool integration, automation, and pipeline operation. Your focus will be on understanding the output of those tools, separating meaningful risk from noise, and partnering with developers to improve the security of the code we write.
What you'll do:
Analyze and validate findings from SAST, DAST, SCA, API security testing, AI-assisted analysis, penetration testing, and code reviews.
Assess vulnerabilities in context, considering exploitability, business impact, compensating controls, and realistic application risk.
Work closely with development teams to explain issues clearly, prioritize remediation, and support secure implementation choices.
Lead or facilitate threat modelling, secure design reviews, and architecture risk reviews for new features, services, APIs, and platforms.
Promote secure coding standards, reusable security patterns, and practical guidance that reduce recurring vulnerability themes.
Provide AppSec subject-matter expertise to improve security testing, reporting, and SDLC processes without owning pipeline integration or tool administration.
What you'll bring:
Strong experience in application security, secure coding, secure-by-design practices, application security testing, and vulnerability management.
Solid understanding of common application and API vulnerability classes, including the OWASP Top 10, and how to remediate them in modern software environments.
Ability to read and reason about code well enough to validate findings, identify root causes, and discuss remediation options with developers.
Experience with threat modelling, architecture risk reviews, secure design reviews, or similar AppSec activities.
Practical knowledge of SAST, DAST, SCA, API security, secrets detection, and related testing approaches, with an emphasis on interpreting results rather than administering tools.
Working knowledge of at least one programming language such as Java, Python, JavaScript, C#, or Go.
Clear communication skills and the ability to translate security risk into practical guidance for engineering, product, and technology leadership audiences.
Collaborative mindset, sound risk judgement, and a coaching style that helps development teams improve their security capability over time.
Qualifications:
Degree in a technology discipline such as Computer Science, Information Management, Computer Engineering, Cybersecurity, or equivalent practical experience. Relevant security certifications such as CISSP, CSSLP, GWAPT, GWEB, or equivalent are preferred but not required.
Before you apply
Applying takes about a minute. These four things decide how fast it moves after that.
Your profile is current
It's what we read first. Occupations, seniority and locations matter more than a long history.
Two examples you can talk through
Not a portfolio — just two pieces of work where you can explain the decisions and what you'd change.
A number in mind
What you're on now and what would make you move. We negotiate better when we know both.
Your notice period
Employers plan around it, and it's the question that stalls offers most often.
Once you apply, someone reads it and calls you before anything reaches the employer — usually within two working days.