Application Security Engineer

Company Description

Cygnostic is a cybersecurity company that helps organizations secure their software, cloud environments, and AI-enabled workflows through a blend of expert services and advanced protection solutions. The team partners closely with CISOs, security teams, and developers to integrate security into the software development lifecycle (SDLC) without slowing down innovation. Cygnostic’s capabilities span proactive risk assessment, secure coding training, cloud and application protection, AI/LLM security, incident response, and automated testing. Its approach focuses on timely vulnerability detection and remediation, reducing alert fatigue, and strengthening secure development practices so organizations can innovate with confidence.

Role Description

The Application Security Engineer is a full-time, hybrid role, with flexibility for partial work from home. In this role, the engineer collaborates with developers, security teams, and product stakeholders to embed security into applications and services across the SDLC. Day-to-day responsibilities include performing application security assessments and code reviews, designing and implementing secure development practices, and supporting automated security testing and runtime protections. The engineer helps define and improve secure coding standards, advises on threat modeling and risk mitigation, and works with teams to triage, prioritize, and remediate vulnerabilities efficiently. The role also involves contributing to security tooling and process improvements, supporting incident investigation related to application-layer threats, and sharing best practices through guidance, documentation, and knowledge sessions.

Qualifications

• Strong application security skills, including experience with secure coding practices, threat modeling, and vulnerability assessment across web, API, and cloud-native applications.
• Hands-on experience with security testing tools (e.g., SAST, DAST, SCA, container and cloud security scanners) and integrating them into CI/CD pipelines.
• Solid software engineering background, with proficiency in at least one modern programming language (such as Java, JavaScript/TypeScript, Python, Go, or C#) and familiarity with common frameworks.
• Knowledge of cloud and infrastructure security concepts, particularly in environments such as AWS, Azure, or GCP, including identity and access management, network controls, and configuration hardening.
• Understanding of modern architectures and workflows, including microservices, containers (Docker, Kubernetes), and AI/LLM-enabled applications and their security considerations.
• Familiarity with security standards and guidelines (e.g., OWASP ASVS/Top 10, NIST, ISO 27001) and experience aligning application security work with broader risk management goals.
• Strong analytical and communication skills, with the ability to explain