{"id":101585,"url":"https://alion.io/job/utexas-senior-application-security-engineer-2","title":"Senior Application Security Engineer","company":{"id":3658,"name":"The University of Texas at Austin","domain":"utexas.edu","url":"https://alion.io/company/utexas","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":77,"open_postings":141,"ghost_share":0,"stale_share":0.901,"repost_share":0.007,"time_to_fill_p50_days":28,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Austin, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":87000,"max_usd":168000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1245},"experience_years_min":8,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"Burp Suite","optional":false},{"name":"Checkmarx","optional":false},{"name":"CI/CD","optional":false},{"name":"CWE","optional":false},{"name":"HIPAA","optional":false},{"name":"Metasploit","optional":false},{"name":"NIST CSF","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"OWASP ZAP","optional":false},{"name":"Platform Engineering","optional":false},{"name":"SonarQube","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Veracode","optional":false}],"status":"live","first_seen_at":"2026-07-24T00:00:00Z","employer_posted_date":"2026-07-24","last_verified_at":"2026-10-17T05:53:39Z","board_verified":true,"closed_at":null,"days_open":85,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":85},"description":"Job Posting Title:\nSenior Application Security Engineer----\nHiring Department:\nDell Medical School----\nPosition Open To:\nAll Applicants----\nWeekly Scheduled Hours:\n40----\nFLSA Status:\nExempt from FLSA----\nEarliest Start Date:\nImmediately----\nPosition Duration:\nExpected to Continue----\nLocation:\nAUSTIN, TX----\nJob Details:\nGeneral Notes\nThe Senior Application Security Engineer is responsible for embedding security throughout the software development lifecycle across Dell Medical School's cloud, platform, and enterprise application environments, including Microsoft Azure, Adobe Experience Cloud, and other cloud platforms. This role partners with development, infrastructure, cybersecurity, clinical, research, and operational teams to strengthen application security, support secure software delivery, and reduce organizational risk while enabling innovation across academic, research, and healthcare environments.\nImportant Employment Information\nThis position is not eligible for employer-sponsored work authorization. Applicants requiring current or future visa sponsorship are not eligible for employment in this position.\nPurpose\nThe Senior Application Security Engineer is responsible for integrating security throughout the software development lifecycle across cloud, platform, and enterprise application environments. This role leads secure code review, application security testing, vulnerability management, cloud security assessments, and secure development initiatives while partnering with development teams to ensure compliance with HIPAA, HITRUST, NIST CSF 2.0, TAC 202, and UTS 165 requirements. The position supports applications developed for academic, research, and clinical environments, including biomedical systems operating within healthcare settings.\nResponsibilities\nSecure Development and Code Review\nDevelop, implement, and maintain Secure Software Development Lifecycle (SSDLC) standards supporting Azure-hosted applications, Adobe Experience Cloud, and other internally managed platforms\n\nSupport secure software development for academic, research, and clinical applications, with an emphasis on higher-risk clinical systems\n\nPerform manual and automated secure code reviews for internally developed applications, identifying vulnerabilities aligned with the OWASP Top 10 and CWE Top 25\n\nIntegrate Static Application Security Testing (SAST) and Software Composition Analysis (SCA) into CI/CD pipelines\n\nPartner with software developers to remediate vulnerabilities and promote secure coding practices through guidance and education\n\nSecurity Testing and Vulnerability Management\nConfigure and operate Burp Suite Professional/Enterprise for Dynamic Application Security Testing (DAST) and authorized penetration testing\n\nUtilize OWASP ZAP for automated and on-demand application security scanning\n\nPerform controlled validation testing using Metasploit during authorized penetration testing engagements\n\nTriage, prioritize, and track remediation efforts through a risk-based vulnerability management process\n\nCoordinate security testing schedules with application owners to minimize operational disruption\n\nSupport QA and automated testing initiatives validating application security controls throughout deployment pipelines\n\nCloud and Platform Security\nAssess Microsoft Azure and other cloud environments for security posture, including identity and access management, network segmentation, and resource-level security controls\n\nReview Adobe Experience Cloud and SaaS/PaaS integrations to ensure secure configuration and appropriate data protection\n\nSupport secure API design, authentication, authorization, and data validation practices\n\nRecommend improvements that strengthen cloud and enterprise application security architecture\n\nAI, Robotics, and Biomedical Systems Security\nAssess the security of AI/ML models, data pipelines, and AI-enabled applications\n\nReview secure integration of generative AI tools, chatbots, and AI-driven APIs supporting institutional applications\n\nEvaluate security controls for robotics programming, automation platforms, and robotic process automation (RPA) solutions\n\nSupport security assessments of biomedical systems and connected medical devices operating within clinical environments\n\nCollaborate with research, innovation, and clinical teams to embed secure development practices throughout AI and robotics initiatives\n\nGovernance, Risk, and Compliance\nAlign application security practices with HIPAA, HITRUST CSF, NIST CSF 2.0, TAC 202, and UTS 165 requirements\n\nSupport third-party risk assessments (TPRM) and application security reviews\n\nParticipate in audit activities, including HITRUST readiness assessments\n\nDevelop and maintain application security policies, standards, and procedures\n\nCross-Functional Collaboration\nPartner with Cybersecurity Analysts on threat modeling, incident response, and architecture reviews for new applications and integrations\n\nCollaborate with the campus Information Security Office (ISO) to support application security standards, risk assessments, vulnerability management, and coordinated incident response\n\nWork closely with Infrastructure, Development, and Platform Engineering teams to integrate security throughout project lifecycles\n\nCommunicate technical findings, security risks, and recommendations to technical and executive stakeholders\n\nMarginal or Periodic Functions\nAdhere to internal controls and reporting structure\n\nPerform related duties as assigned\n\nKnowledge, Skills, and Abilities\nTech Savvy\nMaintain current knowledge of secure software development, cloud security, application security testing, and emerging cybersecurity technologies\n\nEvaluate new tools and technologies that strengthen enterprise application security\n\nApply modern security practices across cloud, application, and software development environments\n\nDecision Quality\nMake sound security decisions balancing organizational risk, operational needs, and regulatory requirements\n\nEvaluate vulnerabilities and recommend practical remediation strategies\n\nPrioritize security initiatives using risk-based methodologies\n\nManages Complexity\nNavigate complex cloud, application, and healthcare technology environments\n\nBalance multiple priorities across development, security, and operational initiatives\n\nIntegrate security controls into rapidly evolving technology ecosystems\n\nCollaborates\nBuild productive working relationships with development, infrastructure, cybersecurity, clinical, research, and operational teams\n\nPromote security awareness and secure development practices throughout the organization\n\nFacilitate collaboration across multidisciplinary technical teams\n\nAction Oriented\nTake ownership of application security initiatives and vulnerability remediation efforts\n\nDrive continuous improvement of secure development practices\n\nRespond proactively to emerging application security risks\n\nEnsures Accountability\nMaintain accountability for application security standards and vulnerability management activities\n\nPromote compliance with organizational security policies and regulatory requirements\n\nSupport secure software delivery through consistent governance and oversight\n\nCommunicates Effectively\nCommunicate technical concepts clearly to both technical and non-technical audiences\n\nPresent security findings, recommendations, and risk assessments effectively\n\nDevelop documentation supporting secure development and application security best practices\n\nRequired Qualifications\nBachelor’s degree in Computer Science, Information Security, Cybersecurity, Software Engineering, or a related field; or an equivalent combination of education and professional experience\n\nMinimum of eight (8) years of experience in application security, secure code review, penetration testing, or secure software development\n\nHands-on experience using Burp Suite, OWASP ZAP, and Metasploit for application security testing and vulnerability validation\n\nExperience with Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) tools such as Checkmarx, Veracode, SonarQube, or similar platforms\n\nExperience securing Microsoft Azure and other cloud environments\n\nExperience implementing secure coding practices across common programming languages and web application frameworks\n\nKnowledge of Secure Software Development Lifecycle (SSDLC) methodologies\n\nStrong analytical, troubleshooting, and problem-solving skills\n\nExcellent verbal and written communication skills\n\nAbility to collaborate effectively with software developers, infrastructure teams, cybersecurity professionals, and business stakeholders\n\nRelevant education and experience may be substituted as appropriate.\nPreferred Qualifications\nExperience supporting healthcare or higher education environments\n\nKnowledge of HIPAA, HITRUST, NIST CSF 2.0, TAC 202, and UTS 165 security frameworks\n\nExperience securing Microsoft Azure, Adobe Experience Cloud, SaaS/PaaS platforms, and cloud-native applications\n\nFamiliarity with AI/ML security concepts, including model security, data governance, prompt injection risks, and adversarial attacks\n\nExperience supporting robotics, robotic process automation (RPA), biomedical systems, or connected medical devices\n\nExperience integrating application security testing into QA processes, automated testing frameworks, and CI/CD pipelines\n\nExperience performing application threat modeling, secure architecture reviews, and third-party risk assessments (TPRM)\n\nLicenses/Registrations/Certifications\nRequired\nNone\n\nPreferred\nOffensive Security Certified Professional (OSCP)\n\nGIAC Web Application Penetration Tester (GWAPT)\n\nCertified Secure Software Lifecycle Professional (CSSLP)\n\nCertified Ethical Hacker (CEH)\n\nMicrosoft Azure Security Engineer Associate (AZ-500)\n\nSalary Range\n$120,000+ depending on qualifications\nWorking Conditions\nStandard office environment and equipment\n\nRepetitive use of a keyboard and computer\n\nHybrid work environment with on-site collaboration as business needs require\n\nMay participate in after-hours security testing, incident response, vulnerability remediation, or critical production support activities\n\nMay be exposed to communicable diseases, blood borne pathogens, ionizing and non-ionizing radiation, hazardous medications, and disoriented or combative patients while supporting healthcare environments\n\nRequired Materials\nResume/CV\n\n3 work references with their contact information; at least one reference should be from a supervisor\n\nLetter of interest\n\nImportant for applicants who are NOT current university employees or contingent workers: You will be prompted to submit your resume the first time you apply, then you will be provided an option to upload a new resume for subsequent applications. Any additional Required Materials (letter of interest, references, etc.) will be uploaded in the Application Questions section, where you may upload multiple files. Before submitting your online job application, ensure that all Required Materials have been uploaded. Once your job application has been submitted, you cannot make changes.\nImportant for Current University employees and contingent workers: As a current university employee or contingent worker, you must apply within Workday by searching Find UT Jobs. Log in to Workday, navigate to your Worker Profile, click the Career link in the left-hand navigation menu, and update your Professional Profile before applying. This information will be pulled into your application. The application is one page, and you will be prompted to upload your resume. In addition, you must respond to the application questions to upload any additional Required Materials noted above.\n----\nEmployment Eligibility:\nRegular staff who have been employed in their current position for the last six continuous months are eligible for openings being recruited for through University-Wide or Open Recruiting, to include both promotional opportunities and la...","description_format":"text","description_chars":15301,"description_truncated":true,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Hybrid work","Retirement plans"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Education","Science & Engineering","STEM Education"],"lifecycle":[{"event":"open","at":"2026-07-24T00:00:00Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 159 · green card filings: 17","filings_12m":159,"filings_prev_12m":199,"green_card_filings_12m":17,"median_offered_wage_usd":93466,"route":null,"cap_exempt":true,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":10,"band":"cold","label":"Long shot","p_open":1,"p_active":0.369,"p_room":0.28,"age_days":85,"expected_fill_days":28,"reasons":["conf:4","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/utexas-senior-application-security-engineer-2","json_url":"https://alion.io/job/utexas-senior-application-security-engineer-2.json","meta":{"generated_at":"2026-10-17T07:12:16Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9867,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3658},"rest":"https://alion.io/mcp/rest/get_company?id=3658"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Futexas-senior-application-security-engineer-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Futexas-senior-application-security-engineer-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Futexas-senior-application-security-engineer-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/utexas-senior-application-security-engineer-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Futexas-senior-application-security-engineer-2"}]}