GuidePoint Security LLC
More roles at GuidePoint Security LLCApplication Security Engineer - Northeast region
Remote role where the employee must remain based in a particular country.
Listed for United States
Source: the job board's country tag. The advert itself does not name United States.
Employer listed it 13 days ago · Added 5 weeks ago
Been open since 5 weeks ago, still being checked, but it has been live a while.
Salary
Not stated
Location
Listed for United States
Timezone
Not stated
Contract
Full-time
Experience
Mid
Category
Software
The employer did not publish a salary, and we have too few comparable roles to estimate one.
What the advert says
Quoted word for word from the employer's advert. Where it says nothing, we say so.
- Working hours
- Not mentioned in the advert
- Where you can work from
Deliver engagements for clients across the Northeast/Mid-Atlantic region, with occasional on-site presence as needed
- Contract
- Not mentioned in the advert
- Experience asked for
- Not mentioned in the advert
- Pay
If you choose the High Deductible / HSA plan, GPS will contribute in 4 equal quarterly installments: ($850 per EE annually / $1750 per family annually (includes spouse/children/family options)
Remote flexibility
Work from home
This is a remote role, but the employee must be based in United States. It is work from home rather than work from anywhere.
What the employer says
- Source listing states candidate location: "Remote, Northeast"
- Job description states: "U.S. based"
What Nomaders makes of it
- Payroll and tax are likely handled in that country only
The quotes above are the employer's own words; the reading is ours. Always check the original listing and employment terms before working from another country.
Before you apply
Experience: employer states
Written as a requirement
- “Required Experience and Education:”
Written as a nice-to-have
- “Experience in software engineering, ideally full stack software development, including modern technologies and application architectures”
- “Preferred Experience and Education”
Questions worth asking: Nomaders interpretation
- The advert does not say whether this is employment or a contractor arrangement. Ask, as it affects tax and benefits.
Produced automatically from this advert's text; not reviewed by a person. The employer's own page is the final word.
About the role
GuidePoint Security provides trusted cybersecurity expertise, solutions and services that help organizations make better decisions and minimize risk. By taking a three-tiered, holistic approach for evaluating security posture and ecosystems, GuidePoint enables some of the nation’s top organizations, such as Fortune 500 companies and U.S. government agencies, to identify threats, optimize resources and integrate best-fit solutions that mitigate risk.
General Description
We are looking for a skilled Application Security Engineer to support the Northeast Application Security practice in delivering application security engineering services to clients, including the implementation, operationalization, and tuning of SAST tooling, integration of security controls into CI/CD pipelines, and adoption of secure development practices across the SDLC. This role will engage in the development of automated security testing capabilities, custom detection rules, and secure pipeline patterns while providing “Wow Them” service to clients and/or internal customers or co-workers.
The Application Security Engineer will be required to demonstrate strong software engineering, security automation, and client communication skills, lead by influence, and strong business/ financial acumen to drive the use of progressive DevSecOps and shift-left security programs that will align the delivery business objectives and priorities.
About the Northeast region Application Security practice
The Northeast Application Security practice is responsible for helping client organizations secure the way they build and deliver software. We assess secure development lifecycle maturity against NIST SSDF and OWASP SAMM, review software supply chain practices against SLSA and SBOM guidance, integrate security testing and policy enforcement into CI/CD pipelines, and deploy and tune SAST, SCA, and DAST tooling across the organization.
Our team of DevSecOps solutions engineers and security architects focuses on secure development lifecycle assessment, CI/CD security integration, and the deployment and tuning of application security tooling. We partner with client development, platform engineering, and application security leadership, as well as GuidePoint's corporate Application Security practice, to reduce noise in scanner output, integrate security into the delivery process without slowing releases, and provide tooling recommendations that reflect how the tools perform in practice rather than how they are marketed.
We help clients get more value from the security tools they already have.
We help clients evaluate and adopt new tooling when it aligns with their objectives.
We help clients establish secure development standards as their teams adopt AI coding assistants and agent-driven engineering workflows.
We evaluate security tooling in practice so our recommendations reflect real performance for each client's environment.
Roles and Responsibilities:
Implement, operationalize, and troubleshoot SAST platforms (e.g., Semgrep, Snyk, CodeQL, Checkmarx, Veracode) within client environments
Design and integrate automated security testing into CI/CD pipelines (e.g., GitHub Actions, GitLab Runners, Azure DevOps, Jenkins, CircleCI)
Author and adapt custom SAST rules (Semgrep, CodeQL) and triage, validate, and guide remediation of identified vulnerabilities
Advise client development teams on OWASP Top 10, threat modeling, and secure coding practices throughout the SDLC
Leverage AI-assisted tooling to accelerate rule development, triage, and remediation guidance
Contribute to reusable pipeline patterns, rule libraries, and delivery accelerators for the AppSec practice
Deliver engagements for clients across the Northeast/Mid-Atlantic region, with occasional on-site presence as needed
Required Experience and Education:
Proficiency with the implementation, operationalization, and troubleshooting of Static Application Security Testing (SAST) tools such as Semgrep, Snyk, CodeQL, Checkmarx, Veracode, etc.
Understanding of Continuous Integration / Continuous Delivery (CI/CD) pipeline tools and processes (e.g. GitHub Actions, GitLab Runners, Azure DevOps, Jenkins, CircleCI, etc.)
Experience in software engineering, ideally full stack software development, including modern technologies and application architectures
Strong scripting and automation experience using one or more programming languages
Requirements
- ·Preferred Experience and Education
- ·Experience writing or adapting custom SAST rules (Semgrep or CodeQL)
- ·Familiarity with additional Application Security tools (e.g. Interactive (IAST), Dynamic (DAST) and API security, SCA, etc.)
- ·Familiarity with API Security tools (e.g., NoName, Traceable, Salt, Cequence)
- ·Practical hands-on experience validating vulnerabilities and proficiency with Burp Suite
Benefits
No benefits package published with this listing. Ask about it at first interview.
How to apply
- 1Check the flexibility label above, work from home, matches where you plan to live and work.
- 2Tailor your CV to the role at GuidePoint Security LLC, mentioning your remote working experience.
- 3Apply directly on the employer's careers page using the button below. Nomaders never handles your application.
Found 1mo ago. Last checked today. Always confirm the details on the original posting, salary and location can change after publication.
Listing sourced from Company boards.
Similar roles
Other open software roles with comparable remote rules.
Pay not stated · You'll be taken to the employer's careers page.