Senior IT Application Security Engineer

October 19, 2026

Senior

Michigan

Description

Senior application security role within a large multi-billion dollar US retailer with more than 70,000 employees. The position acts as a subject matter expert in secure application design, threat modeling, and secure coding practices, driving application security initiatives across the organization. The engineer ensures security checks are followed throughout the SDLC, mentors developers, facilitates third-party penetration tests, and advances the maturity of the application security program

Responsibilities

Develop and provide presentations on application security topics to technical and non-technical audiences
Advise executive leadership on current and evolving threats to enable risk-informed decisions
Mentor members of the information security team on application security matters
Facilitate third-party penetration tests, triage findings, and create remediation plans with development teams
Provide tailored remediation guidance to software developers to address security findings
Provide architectural and security guidance for third-party platforms and services integrated into company environments and code
Review the security of third-party and open-source software used by the company
Provide risk-based analysis of security posture to drive business decisions
Foster relationships with key business partners to create a culture of security and prioritize security initiatives
Develop internal security tooling for identifying or remediating security risks
Assist and lead on matters of application security in the event of an incident

Requirements

Bachelor's degree or above in Computer Science, Information Security, or a related field
At least four years of professional experience, with at least two years in a security field
At least one year of direct experience writing code
Familiar with object-oriented programming and code written in one or more languages such as C#, Java, C++
Knowledge of secure coding best practices such as the OWASP Top 10
Knowledge of common application architectures and the relative risks associated with them, such as single page apps, client-server, native mobile, microservices
Foundational knowledge of security practices in networking, cloud infrastructure, containerization, operations, audit, or governance
Knowledge of relevant technology, tools, databases, and development techniques
Agile/Scrum, SAFe, or Lean certification preferred
SANS/GIAC, CompTIA, ISC2 (e.g. CISSP) or other applicable industry certifications preferred
Strong project management, organization, and team collaboration skills
Ability to define and measure key performance indicators
Strong sense of task ownership with consistent follow-through