Application Security Engineer (Hybrid)

Application Security Engineer Career Opportunity We are seeking a skilled and proactive Application Security Engineer to join our security team. This role is critical in ensuring the security of our applications across platforms including Salesforce,.NET applications, and Azure App Services. The ideal candidate will have a strong background in secure coding practices, Dev Sec Ops, and penetration testing, with hands-on experience managing security tools and integrating them into CI/CD pipelines using Git and Azure Dev Ops. Familiarity with NIST cybersecurity controls and secure design principles is essential. Application Security Engineer Role and Responsibilities Salesforce Security: Review Apex code, Visualforce pages, and Lightning components for security vulnerabilities. Ensure proper configuration of Salesforce security settings including profiles, permission sets, role hierarchies, and sharing rules. Implement and monitor field-level security, object-level access, and record-level access controls. Validate secure integration patterns for external APIs and third-party apps within Salesforce. Enforce OAuth scopes, connected app policies, and IP restrictions. Conduct regular security health checks and Salesforce Shield audits. Align Salesforce security architecture with NIST 800-53 and NIST CSF controls. Secure Development Lifecycle (SDLC): Collaborate with development teams to integrate security best practices into the SDLC. Conduct secure code reviews for applications built on Salesforce,.NET, and Azure platforms. Design and review application architectures to ensure alignment with NIST controls. Perform threat modeling and risk assessments for new and existing applications. Maintain and enhance security integrations with Git, Azure Dev Ops, and other version control systems. Application Security Testing: Perform manual and automated penetration testing of web applications and APIs. Identify and remediate vulnerabilities in Salesforce customizations,.NET codebases, and Azure-hosted services. Tool Management: Own the configuration, tuning, and maintenance of Dev Sec Ops tools (e.g., Sonar Qube, Checkmarx, Veracode, Fortify). Monitor and report on security tool performance and coverage. Governance, Risk & Compliance: Map application security controls to NIST standards and support audit readiness. Document security requirements and ensure traceability to NIST control families. Collaboration & Training: Partner with engineering, QA, and operations teams to drive security awareness and training. Provide guidance on secure coding standards and remediation strategies. Incident Response & Risk Management: Support incident response efforts related to application vulnerabilities. Contribute to risk assessments and mitigation planning for new and existing applications.