What are the responsibilities and job description for the Cybersecurity - Security Engineer Sr. position at Millennium Group?
Senior Application Security Engineer - Policy & Platform
We are seeking a Senior Application Security Engineer to support enterprise application security initiatives with a focus on Application Security Posture Management (ASPM), vulnerability analysis, policy implementation, and developer enablement.
Key Responsibilities
We are seeking a Senior Application Security Engineer to support enterprise application security initiatives with a focus on Application Security Posture Management (ASPM), vulnerability analysis, policy implementation, and developer enablement.
Key Responsibilities
- Administer and support Application Security Posture Management (ASPM) platforms and security tooling.
- Create and tune security policies that determine when vulnerabilities should be escalated, ticketed, suppressed, or prioritized.
- Analyze and validate SAST and SCA findings, including root cause analysis and false-positive identification.
- Partner with development teams to provide secure coding guidance and remediation recommendations.
- Support secure SDLC initiatives and DevSecOps practices across application development teams.
- Assist with platform escalations, vulnerability triage, and security operations activities.
- Leverage automation, APIs, and AI-assisted workflows to improve application security operations.
- Collaborate with cross-functional teams to strengthen security controls throughout the development lifecycle.
- 6-10 years of cybersecurity or application security experience, with more than six years preferred.
- CISSP certification required.
- Deep understanding of Secure SDLC and application security principles.
- Experience with Application Security Posture Management (ASPM) platforms or similar vulnerability management technologies.
- Hands-on experience working with:
- Static Application Security Testing (SAST)
- Software Composition Analysis (SCA)
- API Security Testing
- DAST
- Infrastructure-as-Code (IaC) Security
- Mobile Security Testing
- Ability to read and understand code for vulnerability analysis and root cause identification.
- Experience identifying false positives and validating security findings.
- Familiarity with DevSecOps practices, CI/CD pipelines, and automated security controls.
- Experience integrating and optimizing AppSec tools and platforms.
- Scripting and security workflow automation experience.
- Experience using AI-driven security analysis and policy enforcement capabilities.
- GWEB, GWAPT, CSSLP, or equivalent application security certifications.