Senior Application Security Engineer
Confirmed on the employer's own hiring board on Oct 15, 2026. First seen by Alion on Jul 24, 2026. The University of Texas at Austin scores B on the Alion truth index.
Job Posting Title:
Senior Application Security Engineer----
Hiring Department:
Dell Medical School----
Position Open To:
All Applicants----
Weekly Scheduled Hours:
40----
FLSA Status:
Exempt from FLSA----
Earliest Start Date:
Immediately----
Position Duration:
Expected to Continue----
Location:
AUSTIN, TX----
Job Details:
General Notes
The Senior Application Security Engineer is responsible for embedding security throughout the software development lifecycle across Dell Medical School's cloud, platform, and enterprise application environments, including Microsoft Azure, Adobe Experience Cloud, and other cloud platforms. This role partners with development, infrastructure, cybersecurity, clinical, research, and operational teams to strengthen application security, support secure software delivery, and reduce organizational risk while enabling innovation across academic, research, and healthcare environments.
Important Employment Information
This position is not eligible for employer-sponsored work authorization. Applicants requiring current or future visa sponsorship are not eligible for employment in this position.
Purpose
The Senior Application Security Engineer is responsible for integrating security throughout the software development lifecycle across cloud, platform, and enterprise application environments. This role leads secure code review, application security testing, vulnerability management, cloud security assessments, and secure development initiatives while partnering with development teams to ensure compliance with HIPAA, HITRUST, NIST CSF 2.0, TAC 202, and UTS 165 requirements. The position supports applications developed for academic, research, and clinical environments, including biomedical systems operating within healthcare settings.
Responsibilities
Secure Development and Code Review
Develop, implement, and maintain Secure Software Development Lifecycle (SSDLC) standards supporting Azure-hosted applications, Adobe Experience Cloud, and other internally managed platforms
Support secure software development for academic, research, and clinical applications, with an emphasis on higher-risk clinical systems
Perform manual and automated secure code reviews for internally developed applications, identifying vulnerabilities aligned with the OWASP Top 10 and CWE Top 25
Integrate Static Application Security Testing (SAST) and Software Composition Analysis (SCA) into CI/CD pipelines
Partner with software developers to remediate vulnerabilities and promote secure coding practices through guidance and education
Security Testing and Vulnerability Management
Configure and operate Burp Suite Professional/Enterprise for Dynamic Application Security Testing (DAST) and authorized penetration testing
Utilize OWASP ZAP for automated and on-demand application security scanning
Perform controlled validation testing using Metasploit during authorized penetration testing engagements
Triage, prioritize, and track remediation efforts through a risk-based vulnerability management process
Coordinate security testing schedules with application owners to minimize operational disruption
Support QA and automated testing initiatives validating application security controls throughout deployment pipelines
Cloud and Platform Security
Assess Microsoft Azure and other cloud environments for security posture, including identity and access management, network segmentation, and resource-level security controls
Review Adobe Experience Cloud and SaaS/PaaS integrations to ensure secure configuration and appropriate data protection
Support secure API design, authentication, authorization, and data validation practices
Recommend improvements that strengthen cloud and enterprise application security architecture
AI, Robotics, and Biomedical Systems Security
Assess the security of AI/ML models, data pipelines, and AI-enabled applications
Review secure integration of generative AI tools, chatbots, and AI-driven APIs supporting institutional applications
Evaluate security controls for robotics programming, automation platforms, and robotic process automation (RPA) solutions
Support security assessments of biomedical systems and connected medical devices operating within clinical environments
Collaborate with research, innovation, and clinical teams to embed secure development practices throughout AI and robotics initiatives
Governance, Risk, and Compliance
Align application security practices with HIPAA, HITRUST CSF, NIST CSF 2.0, TAC 202, and UTS 165 requirements
Support third-party risk assessments (TPRM) and application security reviews
Participate in audit activities, including HITRUST readiness assessments
Develop and maintain application security policies, standards, and procedures
Cross-Functional Collaboration
Partner with Cybersecurity Analysts on threat modeling, incident response, and architecture reviews for new applications and integrations
Collaborate with the campus Information Security Office (ISO) to support application security standards, risk assessments, vulnerability management, and coordinated incident response
Work closely with Infrastructure, Development, and Platform Engineering teams to integrate security throughout project lifecycles
Communicate technical findings, security risks, and recommendations to technical and executive stakeholders
Marginal or Periodic Functions
Adhere to internal controls and reporting structure
Perform related duties as assigned
Knowledge, Skills, and Abilities
Tech Savvy
Maintain current knowledge of secure software development, cloud security, application security testing, and emerging cybersecurity technologies
Evaluate new tools and technologies that strengthen enterprise application security
Apply modern security practices across cloud, application, and software development environments
Decision Quality
Make sound security decisions balancing organizational risk, operational needs, and regulatory requirements
Evaluate vulnerabilities and recommend practical remediation strategies
Prioritize security initiatives using risk-based methodologies
Manages Complexity
Navigate complex cloud, application, and healthcare technology environments
Balance multiple priorities across development, security, and operational initiatives
Integrate security controls into rapidly evolving technology ecosystems
Collaborates
Build productive working relationships with development, infrastructure, cybersecurity, clinical, research, and operational teams
Promote security awareness and secure development practices throughout the organization
Facilitate collaboration across multidisciplinary technical teams
Action Oriented
Take ownership of application security initiatives and vulnerability remediation efforts
Drive continuous improvement of secure development practices
Respond proactively to emerging application security risks
Ensures Accountability
Maintain accountability for application security standards and vulnerability management activities
Promote compliance with organizational security policies and regulatory requirements
Support secure software delivery through consistent governance and oversight
Communicates Effectively
Communicate technical concepts clearly to both technical and non-technical audiences
Present security findings, recommendations, and risk assessments effectively
Develop documentation supporting secure development and application security best practices
Required Qualifications
Bachelor’s degree in Computer Science, Information Security, Cybersecurity, Software Engineering, or a related field; or an equivalent combination of education and professional experience
Minimum of eight (8) years of experience in application security, secure code review, penetration testing, or secure software development
Hands-on experience using Burp Suite, OWASP ZAP, and Metasploit for application security testing and vulnerability validation
Experience with Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) tools such as Checkmarx, Veracode, SonarQube, or similar platforms
Experience securing Microsoft Azure and other cloud environments
Experience implementing secure coding practices across common programming languages and web application frameworks
Knowledge of Secure Software Development Lifecycle (SSDLC) methodologies
Strong analytical, troubleshooting, and problem-solving skills
Excellent verbal and written communication skills
Ability to collaborate effectively with software developers, infrastructure teams, cybersecurity professionals, and business stakeholders
Relevant education and experience may be substituted as appropriate.
Preferred Qualifications
Experience supporting healthcare or higher education environments
Knowledge of HIPAA, HITRUST, NIST CSF 2.0, TAC 202, and UTS 165 security frameworks
Experience securing Microsoft Azure, Adobe Experience Cloud, SaaS/PaaS platforms, and cloud-native applications
Familiarity with AI/ML security concepts, including model security, data governance, prompt injection risks, and adversarial attacks
Experience supporting robotics, robotic process automation (RPA), biomedical systems, or connected medical devices
Experience integrating application security testing into QA processes, automated testing frameworks, and CI/CD pipelines
Experience performing application threat modeling, secure architecture reviews, and third-party risk assessments (TPRM)
Licenses/Registrations/Certifications
Required
None
Preferred
Offensive Security Certified Professional (OSCP)
GIAC Web Application Penetration Tester (GWAPT)
Certified Secure Software Lifecycle Professional (CSSLP)
Certified Ethical Hacker (CEH)
Microsoft Azure Security Engineer Associate (AZ-500)
Salary Range
$120,000+ depending on qualifications
Working Conditions
Standard office environment and equipment
Repetitive use of a keyboard and computer
Hybrid work environment with on-site collaboration as business needs require
May participate in after-hours security testing, incident response, vulnerability remediation, or critical production support activities
May be exposed to communicable diseases, blood borne pathogens, ionizing and non-ionizing radiation, hazardous medications, and disoriented or combative patients while supporting healthcare environments
Required Materials
Resume/CV
3 work references with their contact information; at least one reference should be from a supervisor
Letter of interest
Important for applicants who are NOT current university employees or contingent workers: You will be prompted to submit your resume the first time you apply, then you will be provided an option to upload a new resume for subsequent applications. Any additional Required Materials (letter of interest, references, etc.) will be uploaded in the Application Questions section, where you may upload multiple files. Before submitting your online job application, ensure that all Required Materials have been uploaded. Once your job application has been submitted, you cannot make changes.
Important for Current University employees and contingent workers: As a current university employee or contingent worker, you must apply within Workday by searching Find UT Jobs. Log in to Workday, navigate to your Worker Profile, click the Career link in the left-hand navigation menu, and update your Professional Profile before applying. This information will be pulled into your application. The application is one page, and you will be prompted to upload your resume. In addition, you must respond to the application questions to upload any additional Required Materials noted above.
----
Employment Eligibility:
Regular staff who have been employed in their current position for the last six continuous months are eligible for openings being recruited for through University-Wide or Open Recruiting, to include both promotional opportunities and lateral transfers. Staff who are promotion/transfer eligible may apply for positions without supervisor approval.----
Retirement Plan Eligibility:
The retirement plan for this position is Teacher Retirement System of Texas (TRS), subject to the position being at least 20 hours per week and at least 135 days in length.----
Background Checks:
A criminal history background check will be required for finalist(s) under consideration for this position.
----
Equal Opportunity Employer:
The University of Texas at Austin, as an equal opportunity/affirmative action employer, complies with all applicable federal and state laws regarding nondiscrimination and affirmative action. The University is committed to a policy of equal opportunity for all persons and does not discriminate on the basis of race, color, national origin, age, marital status, sex, sexual orientation, gender identity, gender expression, disability, religion, or veteran status in employment, educational programs and activities, and admissions.
----
Pay Transparency:
The University of Texas at Austin will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another employee or applicant. However, employees who have access to the compensation information of other employees or applicants as a part of their essential job functions cannot disclose the pay of other employees or applicants to individuals who do not otherwise have access to compensation information, unless the disclosure is (a) in response to a formal complaint or charge, (b) in furtherance of an investigation, proceeding, hearing, or action, including an investigation conducted by the employer, or (c) consistent with the contractor’s legal duty to furnish information.
----
Employment Eligibility Verification:
If hired, you will be required to complete the federal Employment Eligibility Verification I-9 form. You will be required to present acceptable and original documents to prove your identity and authorization to work in the United States. Documents need to be presented no later than the third day of employment. Failure to do so will result in loss of employment at the university.
----
E-Verify:
The University of Texas at Austin use E-Verify to check the work authorization of all new hires effective May 2015. The university’s company ID number for purposes of E-Verify is 854197. For more information about E-Verify, please see the following:
- E-Verify Poster (English and Spanish) [PDF]
- Right to Work Poster (English) [PDF]
- Right to Work Poster (Spanish) [PDF]
----
Compliance:
Employees may be required to report violations of law under Title IX and the Jeanne Clery Disclosure of Campus Security Policy and Crime Statistics Act (Clery Act). If this position is identified a Campus Security Authority (Clery Act), you will be notified and provided resources for reporting. Responsible employees under Title IX are defined and outlined in HOP-3031.
The Clery Act requires all prospective employees be notified of the availability of the Annual Security and Fire Safety report. You may access the most recent report here or obtain a copy at University Compliance Services, 1616 Guadalupe Street, UTA 2.206, Austin, Texas 78701.