ApplicationSecurityEngineer

Insurance Company Company is seeking a Lead Application Security Engineer to play a critical dual role at the intersection of secure software development and hands‑on engineering leadership. This position is ideal for a technologist who is passionate about building modern applications and ensuring they are secure by design. In this role, you will embed application security expertise directly into the engineering organization. Approximately half of your focus will be on application security, identifying vulnerabilities, guiding remediation efforts, and providing meaningful security metrics and reporting. The other half will be spent leading and contributing to the design, development, and delivery of applications built with Java and Angular. The ideal candidate naturally bridges security and engineering, influencing architecture decisions, mentoring development teams, and championing best practices that balance strong security with scalability, performance, and delivery speed. This position is based in our Scottsdale, AZ office. After completing an initial training period, the role offers a hybrid schedule with four days in the office and one remote day per week. Responsibilities Application Security * Conduct application security assessments and vulnerability scans using Veracode (SAST, DAST, and SCA) across Java, Spring Boot REST services, AngularJS, and Angular applications. * Analyze, prioritize, and track security findings through their full remediation lifecycle, ensuring timely resolution and appropriate escalation. * Hands-on remediate security vulnerabilities directly in Java, Spring Boot, AngularJS, and Angular codebases, while also guiding developers on secure coding practices and mitigation techniques specific to the Java and JavaScript ecosystem. * Review, assess, and implement REST API security controls hands-on, including coding authentication, authorization, input validation, and data protection solutions directly within Spring Boot services. * Produc