Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 31 days ago

Security Engineer (Application Security)

bcbsa23 open roles

Where
Chicago or Washington, D.C.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSecurity Engineer (Application Security)bcbsa · Chicago or Washington, D.C.

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on bcbsa's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

14.0% of postings close within 7 days. Measured by our own scanner across the market. bcbsa postings stay open a median of 29 days.

Share of postings closed within
  1. 2.3%1 day
  2. 4.7%3 days
  3. 14.0%7 days
  4. 22.5%14 days
  5. 38.3%30 days
  6. 59.0%60 days
This job: posted 31 days ago

bcbsa median: 29 days open

The posting

Job Description Summary:

This role will collaborate with architects and key stakeholders to interpret and implement engineering and operational guidance within a specific security domain or program. Contribute to multiple projects, leading the creation of comprehensive roadmaps for various projects or departments. This role will involve championing operational excellence by designing and executing advanced process improvement initiatives. Drive significant cost optimization efforts by identifying and implementing strategic savings opportunities. Additionally, enhance security risk visibility by developing and overseeing robust risk management frameworks. Also, participate in domain-related incident response efforts as needed, maintain defined security architecture, and manage domain-specific security tools.

This specific role will apply application security engineering, assessment, and secure software development practices across cloud-native, web, API, containerized, and microservices-based applications. It supports the application vulnerability assessment lifecycle and integrates security controls and testing throughout the software development lifecycle and DevSecOps pipelines.

Job Description:

  • Works with Architects and key stakeholders to interpret engineering and operational guidance in a specific security domain/program and contributes to multiple projects related to it.
  • Lead the creation of comprehensive roadmaps for multiple projects or departments.
  • Champion operational excellence by designing and executing process improvement initiatives.
  • Drive significant cost optimization efforts by identifying and implementing strategic savings opportunities.
  • Enhance security risk visibility by developing and overseeing robust risk management frameworks.
  • Participate in domain related incident response efforts as needed, maintain defined security architecture, and manage domain specific security tools.

The posting range for this position is:

118,500.00 - 171,825.00

Qualifications:

Education

  • Required Bachelor's Degree in Computer Science, Information Security, or related field or equivalent work experience.

Experience

  • Required 5+ Years Cybersecurity experience with a preferred focus on application security, vulnerability assessments, and secure software development practices
  • Experience implementing risk remediation prioritization and collaboration with key stakeholders to understand risk drivers and remediation blockers.
  • Experience monitoring and tracking remediation efforts, staying abreast of emerging threats, and leading the design, implementation, and maintenance of domain specific toolsets.
  • Experience conducting Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), Software Bill of Materials (SBOM) analysis, API security assessments, secure code reviews, threat modeling, and risk assessments.
  • Experience managing the Application Vulnerability Assessment (AVA) cycle, including planning, vulnerability validation and rating, reporting, remediation guidance and tracking, and validation of fixes.
  • Experience assessing cloud-native, web, API, containerized, and microservices-based applications across Azure, AWS, Kubernetes, and OpenShift.
  • Experience working with internal and external auditors and Governance, Risk, and Compliance (GRC) teams to provide assessment evidence, address findings, and support compliance activities.
  • Experience with Infrastructure as Code technologies, including Terraform, Bicep, ARM Templates, YAML, Docker, Kubernetes manifests, and Helm, and the ability to develop automation and security testing scripts.

Knowledge Skills and Abilities

  • Ability to plan, develop, implement and update company’s information security strategy.
  • Excellent communication skills
  • Excellent presentation skills that cater to technical and non-technical audiences.
  • Advanced analytical and problem-solving skills and ability to manage multiple projects successfully, ensuring timely and budget-friendly completion.
  • Effective interpersonal skills, and the ability to influence and solve problems effectively.
  • Solid understanding of HIPAA/HITRUST requirements, cloud-first security practices, and various security tools and technologies.
  • Advanced knowledge of application security principles and standards, including OWASP Top 10, OWASP API Security Top 10, OWASP ASVS, NIST Cybersecurity Framework, HIPAA, HITRUST, FedRAMP, FISMA, FIPS, and AICPA SOC reporting requirements.
  • Proficiency with application security testing and assessment tools such as Burp Suite, OWASP ZAP, Checkmarx, Veracode, Fortify, GitHub Advanced Security, SonarQube, Postman, and SoapUI.
  • Knowledge of software supply chain, cloud, container, and vulnerability management security tools, including Snyk, Mend/WhiteSource, Black Duck, Dependabot, JFrog Xray, Cortex Cloud, Prisma Cloud, Tenable Cloud Security, Wiz, Aqua Security, Trivy, Microsoft Defender for Cloud, Tenable Vulnerability Management, Brinqa, and ServiceNow Vulnerability Response.
  • Knowledge of DevSecOps platforms and practices, including GitHub Enterprise, GitHub Actions, Azure DevOps, Jenkins, secure software testing, and test-driven development (TDD).
  • Ability to review and assess code written in Python, Java, JavaScript, TypeScript, Node.js, AngularJS, C#, PowerShell, Go, SQL, Bash, and other commonly used shell scripting languages.
  • Ability to identify and assess vulnerabilities such as authentication flaws, authorization weaknesses, insecure APIs, injection attacks, secrets exposure, cloud misconfigurations, and container security risks.
  • Ability to communicate technical findings to developers and translate risk, impact, and remediation guidance for business and other non-technical stakeholders.
  • Ability to drive continuous improvement of application security capabilities, vulnerability management processes, remediation validation, and enterprise risk visibility.
  • Preferred: Demonstrates AI literacy and an understanding of generative AI tools, including appropriate business applications and limitations.

#LI_HYBRID

The posted salary range is the lowest to highest salary we, in good faith, believe we would pay for this role at the time of this posting. We may ultimately pay more or less than the hiring range and this hiring range may also be modified in the future. A candidate’s position within the hiring range may be based on several factors including, but not limited to, specific competencies, relevant education, qualifications, certifications, relevant experience, skills, seniority, performance, shift, travel requirements, and business or organizational needs. This job is also eligible for annual bonus incentive pay.

We offer a comprehensive package of benefits including paid time off, 11 holidays, medical/dental/vision insurance, generous 401(k) matching, lifestyle spending account and many other benefits to eligible employees.

Note: No amount of pay is considered to be wages or compensation until such amount is earned, vested, and determinable. The amount and availability of any bonus, commission, or any other form of compensation that are allocable to a particular employee remains in the Company's sole discretion unless and until paid and may be modified at the Company’s sole discretion, consistent with the law.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against bcbsa's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on bcbsa's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    bcbsa's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.