Spring Health logo
Spring Health

Precise. Personal. Proven. The most comprehensive mental health care for teams and families everywhere.

Senior Application Security Engineer II

Application EngineerApplication EngineerFull TimeRemoteSeniorTeam 501-1,000H1B SponsorCompany SiteLinkedIn

Location

United States

Posted

2 days ago

Salary

$180K - $205.5K / year

Seniority

Senior

Job Description

Senior Application Security Engineer II

Spring Health

Role Description Spring Health is looking for a Senior Application Security Engineer II to join our growing Application Security team. Reporting to the Manager, Application Security, you will play a key role in maturing and expanding our AppSec programs — including established SAST, SCA, and DAST capabilities — while helping shape new initiatives such as a Secure AI Development Lifecycle (ADLC). You will work alongside a team of engineers who have laid a strong foundation, bringing your experience to help take these programs to the next level. This is a full-time, fully remote position open to candidates residing within the United States. Occasional travel to our NYC headquarters may be required. What you’ll do: - Contribute to the advancement of secure-by-design practices within the team’s S-SDLC program, including participation in architecture reviews, design consultations, and security guidance across the development lifecycle. - Mentor engineers on secure coding practices, AppSec fundamentals, and career growth, fostering a collaborative environment where the team grows stronger together. - Facilitate the development of an AI-assisted threat modeling program, spanning risk identification, security architecture, and proactive program maturity, enabling the ability to scale threat modeling across the organization. - Contribute to maturing the team’s established SAST, SCA, and DAST programs through rule tuning, coverage improvements, and identifying opportunities to strengthen security controls as the organization scales. - Perform security-focused code reviews of internal and open-source libraries, prioritizing findings by exploitability and business impact. - Support vulnerability remediation efforts by assessing impact, proposing solutions, and validating fixes in accordance with the team’s established remediation workflows. - Identify and implement process improvements and security automation using languages such as Go, Python, JavaScript, or Ruby, including the integration of AI tooling to improve team workflows and program efficiency. - Contribute to security assessments of AI-integrated product features, including LLM APIs, vector databases, and RAG pipelines, with a focus on risks such as prompt injection, data leakage, and model supply-chain vulnerabilities. - Contribute to the research, design, and development of a Secure AI Development Lifecycle (ADLC) in accordance with the OWASP Top 10 for LLM Applications and emerging adversarial ML guidance. - Evaluate and recommend AI-assisted security tooling, including AI-augmented SAST and LLM-powered code review, to improve program coverage and team efficiency. What success looks like: - Demonstrated improvements to the team’s SAST, SCA, and DAST programs through rule tuning, noise reduction, and coverage expansion within the first 90 days. - Delivery of a documented AI-assisted threat modeling program and foundational ADLC framework, including defined processes, tooling recommendations, and adoption milestones. - Consistent adherence to team SLAs for vulnerability triage and remediation, with measurable contributions to reducing time-to-remediation for high and critical findings. - Delivered security automation and AI tooling integrations that produce measurable improvements to program efficiency or engineering team experience. - Completed security assessments of AI-integrated product features with documented findings, risk ratings, and remediation guidance delivered to engineering teams. Qualifications - 7+ years of professional experience in application security or a closely related security engineering discipline, including experience working on complex, ambiguous problem areas independently. - Hands-on experience with DAST, SAST, and SCA tools, and manual testing techniques (OWASP, SANS Top 25). - Demonstrated experience securing CI/CD pipelines with commercial and custom-built tooling. - Experience with IaaS cloud infrastructure (AWS, Azure, or GCP), container technologies, and service-oriented architectures. - Security automation experience in at least one of: Go, Python, JavaScript, or Ruby. - Familiarity with AI/ML security concepts — prompt injection, adversarial inputs, model supply-chain risks, and the OWASP LLM Top 10. - Working knowledge of AI and LLM tooling (e.g., OpenAI, Anthropic, LangChain, or equivalent) sufficient to assess security risk and integrate into automated workflows. - Experience implementing controls aligned to NIST CSF, HIPAA, HITRUST, ISO-27001, or SOC-2. - Strong cross-functional collaboration skills, with experience working alongside engineering, product, and leadership stakeholders to define and advance security priorities and plans. - Bachelor’s degree in Computer Science, Engineering, MIS, IT, or equivalent work experience. Nice to have: - 3+ years of demonstrated experience in security architecture, including designing and reviewing security controls across cloud-based, distributed, or service-oriented systems. - Experience leading or contributing to the development of a formal threat modeling program, including tooling selection, methodology design, and adoption across engineering teams. - Hands-on experience evaluating or implementing AI security tooling, including AI-augmented testing, LLM security assessments, or automated risk analysis. - Experience managing a bug bounty or vulnerability disclosure program. - Experience in digital health, healthcare technology, or other HIPAA-regulated environments. Benefits - Health, Dental, Vision benefits start on your first day at Spring. - Employer sponsored 401(k) match of up to 2% for retirement planning. - A yearly allotment of no cost visits to the Spring Health network of therapists, coaches, and medication management providers for you and your dependents. - Competitive paid time off policies including vacation, sick leave and company holidays. - At 6 months tenure with Spring, parental leave of 18 weeks for birthing parents and 16 weeks for non-birthing parents. - Access to Noom, a weight management program tailored to your unique needs and goals. - Access to fertility care support through Carrot, in addition to $4,000 reimbursement for related fertility expenses. - Access to Wellhub, which connects employees to the best options for fitness, mindfulness, nutrition, and sleep in one subscription. - Access to BrightHorizons, which provides sponsored child care, back-up care, and elder care. - Up to $1,000 Professional Development Reimbursement a year. - $200 per year donation matching to support your favorite causes.

Related Categories

Related Job Pages

More Application Engineer Jobs

Zeta Global logo

Lead Application Security Engineer

Zeta Global

We deliver better experiences for consumers and better results for your brand.

Full TimeRemoteTeam 1,001-5,000Since 2007H1B Sponsor

• Use AI-assisted threat modeling capabilities to identify application, platform, API, cloud, data, and AI/ML security risks early in the design and development process. • Leverage automated security review tools to evaluate architecture, design documents, code changes, APIs, and data flows for security gaps and control weaknesses. • Drive AI-assisted code security reviews using SAST, DAST, SCA, secrets detection, IaC scanning, container scanning, and contextual risk analysis. • Use automation and intelligent correlation to assess third-party libraries, APIs, vendor integrations, and open-source dependencies for security, compliance, and supply-chain risk. • Support AI-enabled red team, blue team, and incident response simulations to validate detection, prevention, and response capabilities. • Partner with developers and QA engineers to embed AI-driven security testing and automated risk detection into CI/CD pipelines. • Build and improve security automation that provides real-time feedback to developers during design, coding, testing, release, and deployment. • Use AI-assisted analysis to review architecture and design artifacts, identify risks earlier, and recommend secure implementation patterns. • Contribute to intelligent security checkpoints that reduce manual review effort while improving consistency, traceability, and developer velocity. • Help design scalable guardrails, reusable security controls, and policy-as-code capabilities across application and platform teams. • Monitor evolving application, cloud, API, AI/ML, and data security risks using AI-assisted threat intelligence, vulnerability intelligence, and attack-pattern analysis. • Identify and evaluate AI-specific threats such as prompt injection, data poisoning, model abuse, model leakage, insecure tool use, and sensitive data exposure. • Assist in designing and deploying proactive defense mechanisms across applications, APIs, data platforms, and AI-powered systems. • Use automated signals, telemetry, and risk scoring to support investigations, post-incident analysis, and continuous improvement of prevention and detection capabilities. • Translate recurring vulnerabilities and incidents into feedback loops that improve threat models, secure design patterns, and SDLC controls. • Promote secure coding and secure design practices through AI-assisted guidance, reusable playbooks, automated recommendations, and developer-friendly documentation. • Contribute to internal security standards, secure engineering patterns, and AI-native security playbooks. • Help teams adopt security self-service capabilities that reduce dependency on manual AppSec review. • Collaborate closely with Engineering, DevOps, QA, Product, and AI platform teams to foster a security-first and automation-first culture. • Use metrics and insights to measure control effectiveness, remediation trends, developer adoption, and overall security maturity.

United States
$140K - $180K / year
Full TimeRemoteTeam 5,001-10,000H1B Sponsor

• Developing cloud-native microservices and backend components in Golang • Building and maintaining SaaS infrastructure and services for scale and resiliency • Working with GCP, Kubernetes, and Linode, including development of Kubernetes operators • Using Helm, Terraform, GitHub Actions, and other modern tooling to support deployment and automation • Collaborating with other engineers, architects, and product managers to drive features end-to-end • Taking ownership of system design decisions and contribute to the long-term technical roadmap

Israel
Switzerland Global Enterprise logo

Senior Regional Customer Application Engineer

Switzerland Global Enterprise

We support Swiss SMEs in their international business and help innovative foreign companies to establish in Switzerland.

Full TimeRemoteTeam 51-200Since 1927H1B No Sponsor

• Own pre-ITO technical deliverables for all opportunities from assigned account managers, regardless of complexity • Gather from Customers and other sources information about each opportunity and the Customer’s development plan, strategy, and evaluation method • Inform Customers about GE technology and solutions through in-person and online presentations • Use thermodynamic modeling software to model Simple Cycle (SC), Combined Cycle (CC), and Combined Heat & Power (CHP) plants • When appropriate, work cross-functionally to conduct configuration optimization • Conduct economic life-cycle evaluation analysis of GE and competitor solutions for projects prior to RFP • Work closely with New Unit Sales and within the broader Applications Engineering and Product Line Management teams to ensure optimum GE competitiveness and establish a pre-ITO level of technical information flow to develop gas power projects • Proactively assess product fit and define an influencing strategy to best position GE prior to firm bid • Respond to Customer requests for technical information prior to RFP (Request For Proposal, formal), including providing transmission interconnect data and emissions data for permitting • Define and communicate to the ITO proposal team the project background, optimum configuration, necessary approvals obtained, and bid strategy • Gather competitive data and support post win and post mortem analyses including analyzing and reporting back to the business regional Customer needs and trends

New York + 1 moreAll locations: New York | Texas
$113.2K - $188.8K / year
Thrivent Financial logo

Engineer - Java

Thrivent Financial

Thrivent Financial is a faith-based, nonprofit financial services organization dedicated to helping Christians manage their money wisely and generously. Owned b

Role Description As an Engineer you will create and/or modify solutions to complex software problems. This includes coding, testing, debugging, documenting, and maintaining those solutions. You will participate in leading smaller engineering efforts as well as contributing to larger, enterprise-wide initiatives. The Engineering teams are challenged to partner across departments and divisions to achieve the best outcomes for our customers. DUTIES & RESPONSIBILITIES: - Designing Solutions: - Apply technical knowledge to drive outcomes for customers. - Ability to work and problem solve independently on initiatives that align to the broader software engineering strategy. - Proficient at designing solutions within core framework of software products within this team. - Participate in low level design for the product area / within the team. - Designing Software: - Use independent, critical thinking to solve complex problems which are significant to the customer. - Member of team that can work independently, as well as collaboratively with team, in developing core software for the product that delivers outcomes. - Consistent and dependable in delivering core software that delivers outcomes and meets/exceeds the teams expectations for stability, scalability, resilience, etc. - Learning and Applying New Techniques: - Seek out opportunities to learn new technologies that improve the product and its lifecycle. - Collaborating within the Team: - Participate in team’s collaboration sessions to provide technical expertise to solve a problem/remove technical roadblocks for the team. - Participate in product planning and implementation. Helps team to understand and decompose work. - DevOps: - Participates in the team support rotation and builds knowledge on focus subsystems. - Coaching Engineers: - Provide technical expertise and help the team to solve technical/software issues. - Provide trainings to the junior developers and groom them. - Recruiting/Building Talent: - Participate in the interview process or be part of the panel to recruit the right talent to the team. - Models Thrivent’s leadership competencies – courage, collaboration, and commitment by demonstrating resiliency, working together to make the best decisions, and holding yourself and others accountable. - Supports and/or develops an environment in which Thrivent employees and colleagues are focused on continuous improvement, exceptional employee engagement, and an unwavering commitment to our clients. - Shapes and/or supports a culture that represents the Thrivent purpose, promise and values, ensuring that Thrivent’s trust and reputation remain strong with its clients. - Perform other related duties as required. Qualifications - Required: - Bachelor's degree in Computer Science or other technical field or equivalent work experience. - 3 to 5 years of Engineering experience. - Experience using the following technical skills: Java, REST API's, Kafka, Spring Boot, Spring Integration, GitHub. - Experience using AI Tools to improve engineering productivity. - Sound knowledge of Software Development Life Cycle (SDLC). - Knowledge of industry standard Software Development Life Cycle (SDLC) practices. - Knowledge of systems design concepts that provide security and stability. - Deep knowledge of Operating Systems and/or Application Development Platforms. - Ability to debug code and/or complex log files for troubleshooting and analysis of product defects. - Sound understanding of application engineering concepts. - Knowledge/experience with querying databases for data lookup/update. - Preferred: - Financial Services industry experience. - Coach / mentor other team members as appropriate. - GitHub experience. - Playwrite Test Automation. Requirements - Thrivent’s long-term growth depends on attracting, rewarding, and retaining people who are committed to helping others thrive with purpose. - The applicable salary or hourly wage range for this full-time role is $81,537.00 - $110,315.00 per year, which factors in various geographic regions. - The base pay actually offered will be determined by a variety of factors including, but not limited to, location, relevant experience, skills, and knowledge, business needs, market demand, and other factors Thrivent deems important. Benefits - Various bonuses (including, for example, annual or long-term incentives). - Medical, dental, and vision insurance. - Health savings account. - Flexible spending account. - 401k. - Pension. - Life and accidental death and dismemberment insurance. - Disability insurance. - Supplemental protection insurance. - 20 days of Paid Time Off each year. - Sick and Safe Time. - 10 paid company holidays. - Volunteer Time Off. - Paid parental leave. - EAP. - Well-being benefits, and other employee benefits. - Eligibility for receipt of these benefits is subject to the applicable plan/policy documents. - Thrivent’s plans/policies are subject to change at any time at Thrivent’s discretion.

United States
$81.5K - $110.3K / year