Skip to content
jobs·jobs·jobs.com

Remote Application Security Engineer jobs

19 open positions in the United States, newest first.

Application security engineers find and prevent security flaws in the software a company writes. They work inside the development process rather than at the network edge: reviewing designs and code, running security testing tools in the build pipeline and helping developers fix what turns up. The aim is to catch vulnerabilities before release instead of after a breach.

About the Application Security Engineer role

What the work looks like

  • Run threat modeling sessions with engineering teams on new features and architecture changes.
  • Review code and pull requests for injection, authentication, authorization and other common vulnerability classes.
  • Operate static analysis, dependency scanning and dynamic testing tools in CI, and tune out false positives.
  • Triage findings from penetration tests and bug bounty reports, and verify the fixes.
  • Write secure coding guidance and build shared libraries that make the safe approach the easy one.

What employers ask for

  • Secure code review in at least one major language
  • OWASP Top Ten and common vulnerability classes
  • SAST, DAST and software composition analysis tools
  • Threat modeling of new designs
  • Web application testing with Burp Suite
  • Cloud and API security fundamentals

Doing this job remotely

The work happens in repositories, pipelines and design documents, so it travels well, and security teams were often distributed early. Influence is the hard part: developers must be persuaded to fix things, which is easier with relationships built over time. Some employers require hardened devices, background checks or US-based staff, and serious vulnerabilities can demand response outside normal hours.

Where it comes from and where it leads

Most come from software engineering with a security interest, or from penetration testing and security consulting. The path continues to senior and staff security engineer, security architect, product security lead or management of a security team.