Application Security Engineer – SASTDAST & Security Tooling Outage Support

• Jobseeker Video Testimonials
  
• Employee Glassdoor Reviews
  

We are an IT Solutions Integrator/Consulting Firm helping our clients hire the right professional for an exciting long-term project. Here are a few details.

Requirements

Role Summary

We are looking for an Application Security Engineer to support Static and Dynamic Application Security Testing (SAST/DAST) scan and triage activities while also providing hands-on outage support for the security tooling ecosystem including AppScan Checkmarx Cycode and GCP Model Armor. This role combines day-to-day vulnerability triage and remediation guidance with structured SOP-driven incident response when scanning tools are degraded or unavailable including support during scheduled patching windows and off-business-hours coverage.

Key Responsibilities

SAST & DAST Testing and Triage

Perform and support Static (SAST) and Dynamic (DAST) application security testing across in-scope applications.

Triage scan findings across SAST DAST SaaS Secrets and API security scan results distinguishing false positives from confirmed vulnerabilities.

Provide developers with clear actionable remediation guidance for validated vulnerabilities.

Support application onboarding into scan tooling and manage Penalty-Box exception handling and unblock decisions.

Provide security support during production release ACAB reviews and Breakglass approvals.

Create validate and drive Vulnerability Information Tracker (VIT) and defect records through to closure.

AppScan & Checkmarx Windows Server Patching Outage Support

Provide support during scheduled monthly Windows Server patching windows to ensure AppScan and Checkmarx remain available and operational after server restarts.

Validate application access for AppScan and Checkmarx following patching.

Use RDP to connect to in-scope management servers for troubleshooting.

Check IIS Manager to confirm required application pools are in Started status; verify all required HCL AppScan and Cx services are in Running status.

Start any stopped services or application pools; reboot the AppScan management server when required for database-related errors.

Revalidate application login pages after restart and escalate unresolved issues via email or Microsoft Teams.

Cycode Tool Outage Support

Support Cycode-related issues primarily stuck or delayed pull requests during the secret-scanning process.

Review incident details and validate pull request scan history in Cycode; check for missing or delayed pull requests.

Coordinate with the E3 team to verify Azure DevOps webhooks and recent ADO changes and confirm branch policy settings.

Validate whether an actual secret is blocking the pull request and raise a vendor support ticket with Cycode when required.

Coordinate unresolved issues with the appropriate internal teams and Cycode Support until resolution.

GCP Model Armor Support

Provide off-business-hours support for managing Google Cloud Model Armor configurations.

Enable or disable Model Armor for required projects and switch configurations between Inspect Only mode and Inspect and Block mode.

Update the necessary Terraform configuration create pull requests coordinate approvals and trigger pipeline deployments.

Approve Terraform runs in accordance with the SOP coordinating with reviewers and approvers as needed.

Required Skills & Experience

Hands-on experience with SAST and DAST tools and processes (e.g. Checkmarx HCL AppScan or equivalent) including scan triage and false-positive analysis.

Basic Windows Server support knowledge with experience using RDP for remote troubleshooting.

Working knowledge of IIS Manager and Windows Services including starting/stopping services and application pools.

Basic knowledge of Cycode or similar secret-scanning tools Azure DevOps pull request workflows webhooks/service hooks and branch policies.

Basic knowledge of Google Cloud Platform (GCP) Terraform Git repositories pull request processes pipeline deployments and HCP Terraform workspace approvals.

Experience with incident handling vendor coordination and SOP-based outage support procedures.

Strong written and verbal communication skills including the ability to escalate and coordinate via email and Microsoft Teams.

Willingness to support scheduled patching windows and off-business-hours / on-call activities as needed.

Preferred Qualifications

Prior experience in an Application Security Testing (AST) DevSecOps or security operations support role.

Familiarity with vulnerability management workflows (VIT/defect lifecycle: creation validation closure).

Exposure to CI/CD pipelines and infrastructure-as-code approval workflows.

Relevant certifications (e.g. Security GCP Associate/Professional or vendor-specific tool certifications) are a plus.

Soft Skills

Strong attention to detail when following SOP-based procedures under time pressure.

Clear calm communication during live outage or incident scenarios.

Ability to work independently during off-hours support windows while knowing when to escalate.

Benefits