{"id":57680,"url":"https://alion.io/job/nelnet-cybersecurity-application-security-engineer","title":"Cybersecurity Application Security Engineer","company":{"id":15352,"name":"Nelnet","domain":"nelnet.com","url":"https://alion.io/company/nelnet","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":100,"open_postings":3,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":28,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Centennial, United States","Lincoln, United States","Madison, United States","United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":90000,"max":125000,"currency":"USD","period":"year","gross":null,"usd_annual":125000},"salary_estimate":null,"experience_years_min":2,"visa_sponsorship":true,"relocation_package":false,"has_equity":true,"technologies":[{"name":"C#","optional":false},{"name":"CI/CD","optional":false},{"name":"JavaScript","optional":false},{"name":"LLM","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PHP","optional":false},{"name":"Python","optional":false},{"name":"RAG","optional":false},{"name":"STRIDE","optional":false},{"name":"TypeScript","optional":false}],"status":"live","first_seen_at":"2026-08-13T00:00:00Z","employer_posted_date":"2026-08-27","last_verified_at":"2026-10-17T05:24:32Z","board_verified":true,"closed_at":null,"days_open":65,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":65},"description":"Nelnet is a diversified and innovative company committed to enriching lives through the power of service as a student loan servicer, professional services company, consumer loan originator and servicer, payments processor, renewable energy solutions, and K-12 and higher education expert.For over 40 years, Nelnet has been serving its customers, associates, and communities.\nThe perks of working at Nelnet go beyond our benefits package. When you join the Nelnet team, you're part of a community invested in the success of each individual. That support comes through in our work, as we are united by our mission of creating opportunities for people where they live, learn, and work.\nWe are seeking a highly skilled Application Security Engineer with strong experience across secure code review, penetration testing, automation, and modern SDLC practices-including emerging AI/LLM security. In this role, you will partner closely with engineering, cloud, and product teams to safeguard our applications, services, and AI-driven components from design through production. You will combine hands-on technical testing with scalable automation and developer enablement to mature our AppSec program and ensure secure, resilient applications at speed.This position requires work in support of the Company’s contract with the United States Department of Education (“ED”). As such, the United States Government requires that any applicant for this position must complete United States Government security clearance. Effective June 1, 2018, ED has informed Nelnet that security clearance applications for foreign nationals are not being accepted or processed. In light of this direction from ED, Nelnet will be unable to hire applicants without United States citizenship for such positions.\nThis position offers a hybrid work option. Nelnet values flexibility and understands the importance of work-life integration. Our hybrid work environment allows associates Living within 30 miles of an office location to work remotely for part of the week, while also fostering collaboration and team connection through in-office presence three days per week.\nPlease note that we are unable to provide visa sponsorship for this position. To be considered, candidates must already be authorized to work in the United States without the need for current or future sponsorship.\nJob Description\nManual Source Code Review\n\nSAST/DAST scanning\n\nExpand the Security Champions program\n\nDevelop automated source code review processes\n\nWork with product teams to ensure secure SDLC processes are in place\n\nProvide detail vulnerability reports to businesses\n\nEXPERIENCE:\n2-4 years of hands-on application security experience\n\nExperience integrating security tooling and automated checks into CI/CD pipelines\n\nFamiliarity and experience with OWASP Top 10 and web testing methodologies\n\nExperience with effectively assessing and communicating risks and appropriate levels of urgency to management and engineering staff\n\nExperience with technical report writing and communication\n\nCOMPETENCIES - SKILLS/KNOWLEDGE/ABILITIES:\nNeeds:\nStrong manual code review experience in at least one major language (Java, JavaScript/TypeScript, C#, PHP, etc.)\n\nSolid threat-modeling expertise (STRIDE, attack trees, misuse cases) for both traditional systems and AI/LLM-integrated features\n\nProficiency with SAST, SCA, DAST, web and mobile pentesting, container scanners, secrets-detection tools, and ideally AI-security scanning platforms\n\nExperience integrating security tooling and automated checks into CI/CD pipeline\n\nScripting/automation skills (Python, Bash, Node) for building custom tooling and automating manual processes\n\nGood understanding of AI/LLM attack surfaces including prompt injection, insecure output handling, model-data leakage, and RAG vulnerabilities\n\nStrong knowledge of web/API security concepts (session management, secure storage, transport security)\nExcellent organizational, presentation, verbal, and written communication skills\n\nAbility to effectively assess and communicate risks and appropriate levels of urgency to management and engineering staff\n\nAptitude for self-study, setting and achieving long term goals\n\nActively seeks to remain technically current and increase expertise and abilities\n\nChallenges prevailing assumptions when appropriate\n\nWilling to adapt to changing technology and business landscapes\n\nConsiders change as opportunities to be challenged and grow\n\nAbility to adapt style of communications to match audience and information sharing needs\n\nWants:\nExperience performing secure code reviews or building internal developer tooling.\n\nPrevious work with AI or LLM-integrated applications, model security, or prompt safety.\n\nExperience with mobile security, reverse engineering, or platform-specific secure coding.\n\nCertifications such as OSWE, OSCP, GWAPT, GCSA, GCPN, or ML security certs (not required but beneficial).\n\nAbility to mentor junior developers/engineers in secure design and coding practices.\n\nPay range for this role is $90,000-$125,000 annually, depending on experience.\n#LI-CW1\n#LI-Remote\nOur benefits package includes medical, dental, vision, HSA and FSA, generous earned time off, 401K/student loan repayment, life insurance & AD&D insurance, employee assistance program, employee stock purchase program, tuition reimbursement, performance-based incentive pay, short- and long-term disability, and a robust wellness program. Click here to learn more about our benefits: Benefits & Perks - Nelnet Inc.\nNelnet is committed to providing a welcoming and respectful workplace where all associates have the opportunity to succeed. As an Equal Opportunity Employer, we ensure that all qualified applicants are considered for employment. Employment decisions are made without regard to race, color, religion/creed, national origin, gender, sex, marital status, age, disability, use of a guide dog or service animal, sexual orientation, military/veteran status, or any other status protected by federal, state, or local law. We value the unique contributions of every team member and believe that a positive work environment benefits everyone.\nQualified individuals with disabilities who require reasonable accommodations in order to apply or compete for positions at Nelnet may request such accommodations by contacting Corporate Recruiting at 402-486-5725 or .\nNelnet is a Drug Free and Tobacco Free Workplace.\nUse of Artificial Intelligence in Hiring\nWe may use automated or artificial intelligence enabled tools to assist with the initial review of applications, such as identifying relevant skills or experience. These tools are used to support human review and do not make hiring decisions. A recruiter reviews applications and determines which candidates move forward in the hiring process. For more information, see our Privacy Policy and Pre-Use Notice: Automated Tools in Hiring","description_format":"text","description_chars":6932,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["401k plan","Hybrid work","Life insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Application Security","Business Process Outsourcing (BPO)"],"lifecycle":[{"event":"open","at":"2026-08-13T00:00:00Z"}],"visa":[],"liveness":{"score":14,"band":"cold","label":"Long shot","p_open":1,"p_active":0.502,"p_room":0.28,"age_days":65,"expected_fill_days":28,"reasons":["conf:0","velocity","win:tail","crowd:junior"],"computed_at":"2026-10-17T05:46:00Z"},"pay":{"stated_usd_annual":125000,"is_top_pay":true},"html_url":"https://alion.io/job/nelnet-cybersecurity-application-security-engineer","json_url":"https://alion.io/job/nelnet-cybersecurity-application-security-engineer.json","meta":{"generated_at":"2026-10-17T07:35:06Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":10255,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":15352},"rest":"https://alion.io/mcp/rest/get_company?id=15352"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fnelnet-cybersecurity-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fnelnet-cybersecurity-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fnelnet-cybersecurity-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/nelnet-cybersecurity-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fnelnet-cybersecurity-application-security-engineer"}]}