Cybersecurity Application Security Engineer

Nelnet is a diversified and innovative company committed to enriching lives through the power of service as a student loan servicer professional services company consumer loan originator and servicer payments processor renewable energy solutions and K-12 and higher education expert. For over 40 years Nelnet has been serving its customers associates and communities.

The perks of working at Nelnet go beyond our benefits package. When you join the Nelnet team youre part of a community invested in the success of each individual. That support comes through in our work as we are united by our mission of creating opportunities for people where they live learn and work.

We are seeking a highly skilled Application Security Engineer with strong experience across secure code review penetration testing automation and modern SDLC practicesincluding emerging AI/LLM this role you will partner closely with engineering cloud and product teams to safeguard our applications services and AI-driven components from design through production. You will combine hands-on technical testing with scalable automation and developer enablement to mature our AppSec program and ensure secure resilient applications at speed.

This position requires work in support of the Companys contract with the United States Department of Education (ED). As such the United States Government requires that any applicant for this position must complete United States Government security clearance. Effective June 1 2018 ED has informed Nelnet that security clearance applications for foreign nationals are not being accepted or light of this direction from ED Nelnet will be unable to hire applicants without United States citizenship for such positions.

Please note that we are unable to provide visa sponsorship for this position. To be considered candidates must already be authorized to work in the United States without the need for current or future sponsorship.

• Manual Source Code Review

• SAST/DAST scanning

• Expand the Security Champions program

• Develop automated source code review processes

• Work with product teams to ensure secure SDLC processes are in place

• Provide detail vulnerability reports to businesses

• 24 years of hands-on application security experience

• Experience integrating security tooling and automated checks into CI/CD pipelines

• Familiarity and experience with OWASP Top 10 and web testing methodologies

• Experience with effectively assessing and communicating risks and appropriate levels of urgency to management and engineering staff

• Experience with technical report writing and communication

Needs:

• Strong manual code review experience in at least one major language (Java JavaScript/TypeScript C# PHP etc.)

• Solid threat-modeling expertise (STRIDE attack trees misuse cases) for both traditional systems and AI/LLM-integrated features

• Proficiency with SAST SCA DAST web and mobile pentesting container scanners secrets-detection tools and ideally AI-security scanning platforms

• Experience integrating security tooling and automated checks into CI/CD pipeline

• Scripting/automation skills (Python Bash Node) for building custom tooling and automating manual processes

• Good understanding of AI/LLM attack surfaces including prompt injection insecure output handling model-data leakage and RAG vulnerabilities

• Strong knowledge of web/API security concepts (session management secure storage transport security)

  • Excellent organizational presentation verbal and written communication skills

  • Ability to effectively assess and communicate risks and appropriate levels of urgency to management and engineering staff

  • Aptitude for self-study setting and achieving long term goals

  • Actively seeks to remain technically current and increase expertise and abilities

  • Challenges prevailing assumptions when appropriate

  • Willing to adapt to changing technology and business landscapes

  • Considers change as opportunities to be challenged and grow

  • Ability to adapt style of communications to match audience and information sharing needs

Wants:

• Experience performing secure code reviews or building internal developer tooling.

• Previous work with AI or LLM-integrated applications model security or prompt safety.

• Experience with mobile security reverse engineering or platform-specific secure coding.

• Certifications such as OSWE OSCP GWAPT GCSA GCPN or ML security certs (not required but beneficial).

• Ability to mentor junior developers/engineers in secure design and coding practices.

Pay range for this role is $90000-$125000 annually depending on experience.

#LI-CW1
#LI-Hybrid

Our benefits package includes medical dental vision HSA and FSA generous earned time off 401K/student loan repayment life insurance & AD&D insurance employee assistance program employee stock purchase program tuition reimbursement performance-based incentive pay short- and long-term disability and a robust wellness program. Click here to learn more about our benefits: Benefits & Perks - Nelnet Inc.

Nelnet is committed to providing a welcoming and respectful workplace where all associates have the opportunity to succeed. As an Equal Opportunity Employer we ensure that all qualified applicants are considered for employment. Employment decisions are made without regard to race color religion/creed national origin gender sex marital status age disability use of a guide dog or service animal sexual orientation military/veteran status or any other status protected by federal state or local law. We value the unique contributions of every team member and believe that a positive work environment benefits everyone.

Qualified individuals with disabilities who require reasonable accommodations in order to apply or compete for positions at Nelnet may request such accommodations by contacting Corporate Recruiting at or.

Nelnet is a Drug Free and Tobacco Free Workplace.

Use of Artificial Intelligence in Hiring

We may use automated or artificial intelligence enabled tools to assist with the initial review of applications such as identifying relevant skills or experience. These tools are used to support human review and do not make hiring decisions. A recruiter reviews applications and determines which candidates move forward in the hiring process. For more information see our Privacy Policy and Pre-Use Notice: Automated Tools in Hiring