Application Security Engineer

Zelis Healthcare - Morristown, NJ

Full-time

Remote - Morristown, NJ

Professional, Scientific, and Technical Services

About the position

The Application Security Engineer at Zelis is responsible for ensuring the security of corporate applications by collaborating with application development teams. This role involves identifying application assets, data flows, threats, and implementing necessary cybersecurity controls. The engineer will also work with Application Security Testers to assess the effectiveness of these controls, contributing to a secure application development lifecycle.

Responsibilities

• Partner closely with corporate stakeholders to understand regulatory, industry, and organizational security requirements
• Provide security requirements with acceptance criteria to application development teams using Agile and Waterfall methodologies
• Conduct threat modeling exercises to identify potential security vulnerabilities in corporate applications
• Analyze application's components, data flows, and external dependencies to anticipate and mitigate threats
• Review the architecture of software applications to ensure that security is integrated at every layer, including network, infrastructure, and application levels
• Implement security controls and best practices to address identified risks and vulnerabilities, including encryption, authentication, access controls, input validation, and other security mechanisms
• Perform security code reviews to identify and remediate security vulnerabilities in application code
• Provide guidance and training to development teams on secure coding practices, security principles, and relevant security tools and technologies
• Evaluate and implement security tools and automation solutions to enhance the security posture of applications and streamline security processes

Requirements

• Bachelor's degree in Cyber Security or related degree
• 4+ years of experience in Cyber Security
• 2+ years of experience in Agile and writing user stories
• 2+ years of experience in Application Security and Threat Modeling
• Understanding of API and Web security vulnerabilities
• 2+ years of experience using Octave or Stride
• Experience working within a DevSecOps environment

Nice-to-haves

• Experience in security coding, source code management, and/or build and deployment technologies
• Experience with web application firewalls
• Familiarity with OWASP Top 10 API, Web, and Mobile Application Security Risks
• Familiarity with MITRE CWE Top 25 Most Dangerous Software Weaknesses
• CDP, CISSP, E|CDE or other relevant certifications
• Familiarity with regulatory controls and industry best practices such as HIPAA, PCI, CIS, HiTrust, ISO 27001, NIST