Cybersecurity Application Security Engineer

Description

• Manual Source Code Review

• SAST/DAST scanning

• Expand the Security Champions program

• Develop automated source code review processes

• Work with product teams to ensure secure SDLC processes are in place

• Provide detail vulnerability reports to businesses

EXPERIENCE:

• 2–4 years of hands-on application security experience

• Experience integrating security tooling and automated checks into CI/CD pipelines

• Familiarity and experience with OWASP Top 10 and web testing methodologies

• Experience with effectively assessing and communicating risks and appropriate levels of urgency to management and engineering staff

• Experience with technical report writing and communication

COMPETENCIES – SKILLS/KNOWLEDGE/ABILITIES:

Needs:

• Strong manual code review experience in at least one major language (Java, JavaScript/TypeScript, C#, PHP, etc.)

• Solid threat-modeling expertise (STRIDE, attack trees, misuse cases) for both traditional systems and AI/LLM-integrated features

• Proficiency with SAST, SCA, DAST, web and mobile pentesting, container scanners, secrets-detection tools, and ideally AI-security scanning platforms

• Experience integrating security tooling and automated checks into CI/CD pipeline

• Scripting/automation skills (Python, Bash, Node) for building custom tooling and automating manual processes

• Good understanding of AI/LLM attack surfaces including prompt injection, insecure output handling, model-data leakage, and RAG vulnerabilities

• Strong knowledge of web/API security concepts (session management, secure storage, transport security)

  • Excellent organizational, presentation, verbal, and written communication skills

  • Ability to effectively assess and communicate risks and appropriate levels of urgency to management and engineering staff

  • Aptitude for self-study, setting and achieving long term goals

  • Actively seeks to remain technically current and increase expertise and abilities

  • Challenges prevailing assumptions when appropriate

  • Willing to adapt to changing technology and business landscapes

  • Considers change as opportunities to be challenged and grow

  • Ability to adapt style of communications to match audience and information sharing needs

Wants:

• Experience performing secure code reviews or building internal developer tooling.

• Previous work with AI or LLM-integrated applications, model security, or prompt safety.

• Experience with mobile security, reverse engineering, or platform-specific secure coding.

• Certifications such as OSWE, OSCP, GWAPT, GCSA, GCPN, or ML security certs (not required but beneficial).

• Ability to mentor junior developers/engineers in secure design and coding practices.

Pay range for this role is $90,000-$125,000 annually, depending on experience.

#LI-CW1
#LI-Remote

Our benefits package includes medical, dental, vision, HSA and FSA, generous earned time off, 401K/student loan repayment, life insurance & AD&D insurance, employee assistance program, employee stock purchase program, tuition reimbursement, performance-based incentive pay, short- and long-term disability, and a robust wellness program. Click here to learn more about our benefits: .

Nelnet is committed to providing a welcoming and respectful workplace where all associates have the opportunity to succeed. As an Equal Opportunity Employer, we ensure that all qualified applicants are considered for employment. Employment decisions are made without regard to race, color, religion/creed, national origin, gender, sex, marital status, age, disability, use of a guide dog or service animal, sexual orientation, military/veteran status, or any other status protected by federal, state, or local law. We value the unique contributions of every team member and believe that a positive work environment benefits everyone.

Qualified individuals with disabilities who require reasonable accommodations in order to apply or compete for positions at Nelnet may request such accommodations by