Sr. Engineer: Application Security

Job Title:

Job Description

The global technology and services leader that powers the world’s best brands, today and into the future. We’re solution-focused, tech-powered, intelligence-fueled. With unique data and insights, deep industry expertise, and advanced technology solutions, we’re the intelligent transformation partner that powers a world that works, helping companies become refreshingly simple to work, interact, and transact with. We shape new game-changing careers in over 70 countries, attracting the best talent.

The Concentrix Technical Products and Services team is the driving force behind Concentrix’s transformation, data, and technology services. We integrate world-class digital engineering, creativity, and a deep understanding of human behavior to find and unlock value through tech-powered and intelligence-fueled experiences. We combine human-centered design, powerful data, and strong tech to accelerate transformation at scale. You will be surrounded by the best in the world providing market leading technology and insights to modernize and simplify the customer experience. Within our professional services team, you will deliver strategic consulting, design, advisory services, market research, and contact center analytics that deliver insights to improve outcomes and value for our clients. Hence achieving our vision.

Our game-changers around the world have devoted their careers to ensuring every relationship is exceptional. And we’re proud to be recognized with awards such as "World's Best Workplaces," “Best Companies for Career Growth,” and “Best Company Culture,” year after year.

Join us and be part of this journey towards greater opportunities and brighter futures.

V - Sr. Engineer: Application Security Position: Senior Security Engineer - AppSec Department: 9909153 - IT Mountain Applications

Job Summary: The Senior Application Security Engineer acts as the bridge between Information Security and our Software Development teams. This role is responsible for securing the Software Development Life Cycle (SDLC) by integrating security tooling directly into CI/CD pipelines and performing technical security assessments on proprietary applications.

Crucially, this role is a cultural leader. You will build and nurture a "Security Champions" program, empowering developers to take ownership of security within their own products. You are not just finding bugs; you are teaching teams how to build secure code by design, fostering a partnership based on trust and mutual goals.

Who you are:

• Developer-Centric: You think like a developer because you have been one. You understand the pressure of sprint deadlines and strive to make security "frictionless."
• Relationship Builder: You know that the best way to secure software is to have the developers on your side. You approach vulnerability discussions with empathy and a "how do we fix this together" attitude.
• Curious & Technical: You love digging into code logic to find the flaw that automated scanners missed.
• Teacher & Mentor: You enjoy explaining why a Cross-Site Scripting (XSS) vulnerability is dangerous and demonstrating how to write the code to prevent it.
• Pragmatic: You can distinguish between a theoretical risk and a practical exploit, helping business leaders make informed shipping decisions.

Responsibilities include:

• Security Champions Program: Help to launch, and manage a formal Security Champions program. Identify key advocates within development teams, provide them with advanced training, and build a community of practice.
• Secure SDLC (DevSecOps): Engineer and maintain the integration of security testing tools (SAST, DAST, SCA) into the CI/CD pipeline (e.g., Azure DevOps, Jenkins, GitLab) to provide rapid feedback to developers.
• Application Security Testing: Conduct manual and automated penetration tests and code reviews on web applications, APIs, and mobile apps prior to release.
• Threat Modeling: Partner with engineering teams during the architecture/design phase to perform threat modeling (STRIDE/PASTA), identifying design flaws before code is even written.
• Vulnerability Management (AppSec): Triaging results from application scans, removing false positives, and creating clear, actionable Jira tickets for engineering teams.
• Developer Training: Create and deliver secure coding training (e.g., OWASP Top 10) tailored to the specific technology stacks used by the organization.
• Tool Engineering: Evaluate application security technologies and their reports (e.g., Stackhawk, or Qualys WAS).
• Policy & Standards: Assist in developing application security standards and coding guidelines that align with industry frameworks (ASVS, NIST). Experience you’ll need:
• Bachelor’s degree in computer science, software engineering, information security, or equivalent experience.
• Development Background: Significant experience in software development or scripting (e.g., Java, .NET/C#, Python, JavaScript/Node.js). You must be able to read and understand the code you are securing.
• AppSec Expertise: Deep understanding of the OWASP Top 10, SANS 25, and common attack vectors (SQLi, XSS, CSRF, IDOR) and their remediations.
• Pipeline Engineering: Hands-on experience integrating security tools into CI/CD pipelines (Azure DevOps, GitHub Actions, Jenkins).
• Tool Proficiency: Experience with SAST (Static Analysis), DAST (Dynamic Analysis), and SCA (Software Composition Analysis) tools.
• Cultural Leadership: Demonstrated experience building relationships with development teams or leading "Security Champions" initiatives.
• API Security: Strong understanding of API security, JSON Web Tokens (JWT), and API gateways.
• Communication: Ability to explain complex security exploits to non-security audiences and influence stakeholders to prioritize technical debt.
• Cloud Native Security: Familiarity with securing cloud-native applications (containers, Kubernetes, Serverless) in AWS or Azure. Preferred Experience:
• Certifications: CASE (Certified Application Security Engineer), CSSLP, GWEB, or OSCP (Offensive Security Certified Professional).
• Experience with Qualys Web App Scanning (WAS) module.
• Experience with "Infrastructure as Code" (IaC) security scanning (e.g., Terraform, Ansible).
• Contribution to open-source security projects or bug bounty programs.

Location:

Language Requirements:

Time Type: