26-4001: Application Security Engineer.

Provide security engineering support for web and API applications. Integrate security controls into Secure SDLC, including threat modeling and security design reviews. Ensure adherence to organizational security standards and best practices. Vulnerability Scanning & Tool Administration Administer and manage vulnerability scanning tools (e.g., Tenable or similar). Configure, tune, and maintain scanning policies and schedules. Optimize tool performance to improve accuracy and reduce false positives. SAST & DAST Integration Implement and maintain SAST and DAST tools within CI/CD pipelines. Configure detection rules and improve result reliability. Collaborate with engineering teams to ensure seamless integration and actionable outputs. Vulnerability Discovery & Risk Prioritization Identify and validate vulnerabilities through automated and manual testing. Perform false-positive analysis and assess exploitability. Provide risk-based prioritization aligned with business impact. Operational Execution & Remediation Review scan results and track vulnerabilities to closure. Coordinate with development teams for timely remediation. Ensure adherence to defined workflows and SLAs. Red Team & Offensive Security Techniques Validate vulnerabilities using manual testing and offensive security methods. Develop proof-of-concept exploits where required. Document attack paths, reproduction steps, and impact clearly. Security Testing & Bug Validation Perform manual and automated security testing for applications and APIs. Reproduce and validate reported issues across environments. Verify remediation effectiveness before closure. Bachelor’s degree in computer science, Information Security, or related field. 3–6 years of experience in Application Security or related domain. Hands-on experience with SAST, DAST, and vulnerability scanning tools. Strong understanding of OWASP Top 10, web application and API security. Experience with CI/CD pipeline integrations (e.g., Jenkins, GitHub Actions, GitLab). Knowledge of secure coding practices and common vulnerability patterns. Familiarity with scripting (Python, Bash, or similar) is a plus. Experience with threat modeling and secure design reviews. Exposure to red teaming or penetration testing techniques. Relevant certifications (e.g., OSCP, CEH, GWAPT) are a plus. The pay range provided is a good-faith estimate and represents the range the company reasonably expects to pay for this position at the time of posting. Individual compensation may vary based on skills, experience, education, certifications, geographic location, and business needs. Equal Employer/Veterans/Disabled Navitas Business Consulting is an affirmative action and equal opportunity employer. If reasonable accommodation is needed to participate in the job application or interview process, to perform essential job functions, and/or to receive other benefits and privileges of employment, please contact Navitas Human Resources. Navitas is an equal opportunity employer. We provide employment and opportunities for advancement, compensation, training, and growth according to individual merit, without regard to race, color, religion, sex (including pregnancy), national origin, sexual orientation, gender identity or expression, marital status, age, genetic information, disability, veteran-status veteran or military status, or any other characteristic protected under applicable Federal, state, or local law. Our goal is for each staff member to have the opportunity to grow to the limits of their abilities and to achieve personal and organizational objectives. We will support positive programs for equal treatment of all staff and full utilization of all qualified employees at all levels within Navitas. Originally posted on Himalayas