{"id":2519404,"url":"https://alion.io/job/blue-cross-blue-shield-association-security-engineer-application-security","title":"Security Engineer (Application Security)","company":{"id":1762299,"name":"Blue Cross Blue Shield Association","domain":"bcbs.com","url":"https://alion.io/company/bcbs-com","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Washington, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":111000,"max_usd":215000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1245},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Aqua Security","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Azure DevOps","optional":false},{"name":"Bash","optional":false},{"name":"Bicep","optional":false},{"name":"Burp Suite","optional":false},{"name":"C#","optional":false},{"name":"Checkmarx","optional":false},{"name":"Cortex","optional":false},{"name":"Dependabot","optional":false},{"name":"Docker","optional":false},{"name":"FedRAMP","optional":false},{"name":"Fortify","optional":false},{"name":"GitHub","optional":false},{"name":"GitHub Actions","optional":false},{"name":"Helm","optional":false},{"name":"HIPAA","optional":false},{"name":"JavaScript","optional":false},{"name":"Jenkins","optional":false},{"name":"JFrog Xray","optional":false},{"name":"Kubernetes","optional":false},{"name":"Mend","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"Node JS","optional":false},{"name":"OpenShift","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP ASVS","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"OWASP ZAP","optional":false},{"name":"Postman","optional":false},{"name":"PowerShell","optional":false},{"name":"Prisma Cloud","optional":false},{"name":"Python","optional":false},{"name":"SBOM","optional":false},{"name":"ServiceNow","optional":false},{"name":"Snyk","optional":false},{"name":"SoapUI","optional":false},{"name":"SonarQube","optional":false},{"name":"SQL","optional":false},{"name":"Terraform","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Trivy","optional":false},{"name":"TypeScript","optional":false},{"name":"Veracode","optional":false},{"name":"Wiz","optional":false},{"name":"Prometheus","optional":true}],"status":"live","first_seen_at":"2026-10-13T00:00:00Z","employer_posted_date":"2026-10-13","last_verified_at":"2026-10-15T21:51:03Z","board_verified":true,"closed_at":null,"days_open":3,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":3},"description":"Job Description Summary:This role will collaborate with architects and key stakeholders to interpret and implement engineering and operational guidance within a specific security domain or program. Contribute to multiple projects, leading the creation of comprehensive roadmaps for various projects or departments. This role will involve championing operational excellence by designing and executing advanced process improvement initiatives. Drive significant cost optimization efforts by identifying and implementing strategic savings opportunities. Additionally, enhance security risk visibility by developing and overseeing robust risk management frameworks. Also, participate in domain-related incident response efforts as needed, maintain defined security architecture, and manage domain-specific security tools.\nThis specific role will apply application security engineering, assessment, and secure software development practices across cloud-native, web, API, containerized, and microservices-based applications. It supports the application vulnerability assessment lifecycle and integrates security controls and testing throughout the software development lifecycle and DevSecOps pipelines.\nJob Description:\nWorks with Architects and key stakeholders to interpret engineering and operational guidance in a specific security domain/program and contributes to multiple projects related to it.\nLead the creation of comprehensive roadmaps for multiple projects or departments.\nChampion operational excellence by designing and executing process improvement initiatives.\nDrive significant cost optimization efforts by identifying and implementing strategic savings opportunities.\nEnhance security risk visibility by developing and overseeing robust risk management frameworks.\nParticipate in domain related incident response efforts as needed, maintain defined security architecture, and manage domain specific security tools.\nThe posting range for this position is:\n118,500.00 - 171,825.00Qualifications:\nEducation\nRequired Bachelor's Degree in Computer Science, Information Security, or related field or equivalent work experience.\nExperience\nRequired 5+ Years Cybersecurity experience with a preferred focus on application security, vulnerability assessments, and secure software development practices\nExperience implementing risk remediation prioritization and collaboration with key stakeholders to understand risk drivers and remediation blockers.\nExperience monitoring and tracking remediation efforts, staying abreast of emerging threats, and leading the design, implementation, and maintenance of domain specific toolsets.\nExperience conducting Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), Software Bill of Materials (SBOM) analysis, API security assessments, secure code reviews, threat modeling, and risk assessments.\nExperience managing the Application Vulnerability Assessment (AVA) cycle, including planning, vulnerability validation and rating, reporting, remediation guidance and tracking, and validation of fixes. \nExperience assessing cloud-native, web, API, containerized, and microservices-based applications across Azure, AWS, Kubernetes, and OpenShift. \nExperience working with internal and external auditors and Governance, Risk, and Compliance (GRC) teams to provide assessment evidence, address findings, and support compliance activities.\nExperience with Infrastructure as Code technologies, including Terraform, Bicep, ARM Templates, YAML, Docker, Kubernetes manifests, and Helm, and the ability to develop automation and security testing scripts.\n Knowledge Skills and Abilities\nAbility to plan, develop, implement and update company’s information security strategy.\nExcellent communication skills \nExcellent presentation skills that cater to technical and non-technical audiences. \nAdvanced analytical and problem-solving skills and ability to manage multiple projects successfully, ensuring timely and budget-friendly completion. \nEffective interpersonal skills, and the ability to influence and solve problems effectively. \nSolid understanding of HIPAA/HITRUST requirements, cloud-first security practices, and various security tools and technologies.\nAdvanced knowledge of application security principles and standards, including OWASP Top 10, OWASP API Security Top 10, OWASP ASVS, NIST Cybersecurity Framework, HIPAA, HITRUST, FedRAMP, FISMA, FIPS, and AICPA SOC reporting requirements. \nProficiency with application security testing and assessment tools such as Burp Suite, OWASP ZAP, Checkmarx, Veracode, Fortify, GitHub Advanced Security, SonarQube, Postman, and SoapUI.\nKnowledge of software supply chain, cloud, container, and vulnerability management security tools, including Snyk, Mend/WhiteSource, Black Duck, Dependabot, JFrog Xray, Cortex Cloud, Prisma Cloud, Tenable Cloud Security, Wiz, Aqua Security, Trivy, Microsoft Defender for Cloud, Tenable Vulnerability Management, Brinqa, and ServiceNow Vulnerability Response. \nKnowledge of DevSecOps platforms and practices, including GitHub Enterprise, GitHub Actions, Azure DevOps, Jenkins, secure software testing, and test-driven development (TDD).\nAbility to review and assess code written in Python, Java, JavaScript, TypeScript, Node.js, AngularJS, C#, PowerShell, Go, SQL, Bash, and other commonly used shell scripting languages. \nAbility to identify and assess vulnerabilities such as authentication flaws, authorization weaknesses, insecure APIs, injection attacks, secrets exposure, cloud misconfigurations, and container security risks. \nAbility to communicate technical findings to developers and translate risk, impact, and remediation guidance for business and other non-technical stakeholders.\nAbility to drive continuous improvement of application security capabilities, vulnerability management processes, remediation validation, and enterprise risk visibility.\nPreferred: Demonstrates AI literacy and an understanding of generative AI tools, including appropriate business applications and limitations.\n#LI_HYBRID\nThe posted salary range is the lowest to highest salary we,in good faith,believe we would pay for this role at the time of this posting. We may ultimately paymore or less than the hiring rangeandthis hiringrange may also be modified in the future. A candidate’s position within the hiringrange may be based on several factors including, but not limited to, specific competencies, relevant education, qualifications, certifications, relevant experience, skills, seniority, performance, shift, travel requirements, andbusiness or organizational needs.This job is also eligible for annual bonusincentivepay.\nWe offer a comprehensivepackage of benefits including paidtime off,11 holidays,medical/dental/visioninsurance, generous 401(k)matching,lifestyle spending accountand many other benefits to eligible employees.\nNote: No amount of pay is considered to be wages or compensation until such amount is earned, vested, and determinable.The amount and availability of any bonus, commission, or any other form of compensation that are allocable to a particular employee remainsin the Company's sole discretion unless and until paid and may be modifiedat the Company’s sole discretion, consistent with the law.","description_format":"text","description_chars":7310,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Health Insurance & Benefits"],"lifecycle":[{"event":"open","at":"2026-10-14T10:34:44Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 16","filings_12m":16,"filings_prev_12m":2,"green_card_filings_12m":0,"median_offered_wage_usd":142500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":1}],"liveness":{"score":88,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.885,"p_room":1,"age_days":3,"expected_fill_days":12,"reasons":["conf:7","velocity","win:early"],"computed_at":"2026-10-16T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/blue-cross-blue-shield-association-security-engineer-application-security","json_url":"https://alion.io/job/blue-cross-blue-shield-association-security-engineer-application-security.json","meta":{"generated_at":"2026-10-16T06:33:12Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4300,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-17T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1762299},"rest":"https://alion.io/mcp/rest/get_company?id=1762299"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fblue-cross-blue-shield-association-security-engineer-application-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fblue-cross-blue-shield-association-security-engineer-application-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fblue-cross-blue-shield-association-security-engineer-application-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/blue-cross-blue-shield-association-security-engineer-application-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fblue-cross-blue-shield-association-security-engineer-application-security"}]}