Advanced Specialist, Application Security

Pearson VUE

. Own and continuously improve a repeatable Application Security process across the software development lifecycle .

Posted 10/27/2026full-timeDurham • North Carolina • United StatesMid-LevelSenior💰 $100,000 - $160,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in Application Security, including threat modeling, secure design reviews, and integrating security into CI/CD pipelines. Proficient in utilizing various AppSec tools and frameworks while effectively communicating application risks to stakeholders.

Highest-signal resume keywords

Application Security ExperienceThreat ModelingSAST, SCA, Secrets ScanningCI/CD IntegrationCloud Security in Azure/AWS

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Threat ModelingSecure Design ReviewSASTSCASecrets ScanningContainer ScanningIaC ScanningPython ScriptingRisk-Based Release GatesOWASP Top 10

Soft Skills

Excellent CommunicationMentoringCoaching

Tools & Technologies

AppSec ToolchainCI/CD PipelinesRASPWAFVulnerability Aggregation Platforms

Certifications & Qualifications

CISSPCSSLPCCSP

Industry Keywords

FedRAMPGovRAMPUK Cyber Essentials PlusEU GDPRNIS2China MLPSSaudi NCA ECCAustralia ASD Essential Eight

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityPython

About the role

Key responsibilities & impact

Own and continuously improve a repeatable Application Security process across the software development lifecycle
Define AppSec activities, tools, evidence, ownership and finding-handling procedures with Enterprise Application Security
Lead threat modeling, use-case review and secure design review, including authentication, authorization, privacy and logging requirements
Set risk-based security gates and ensure findings are assigned, triaged, remediated, accepted or closed
Own selection, design, onboarding and optimization of the AppSec toolchain, including SAST, SCA, secrets scanning, IaC scanning, container scanning, DAST and IAST/RASP
Operate and mature the AppSec stack across development pipelines and code repositories
Drive repository and space onboarding to close coverage gaps and discover unscanned origins
Enforce CI/CD gates, SBOM generation, image scanning and artifact signing
Automate triage, ticket routing and evidence collection
Assist with tuning preventative technologies such as RASP and WAF
Translate sovereign and regulated requirements into concrete application security controls and defensible evidence
Validate application architecture against sovereign requirements
Provide application penetration-test scoping and manage remediation through closure
Lead technical audit preparation and evidence-quality review; support POA&M and continuous monitoring cycles
Engage with 3PAOs, external assessors and government customers on application-control questions
Act as the application-security entry point at project intake and cybersecurity kickoff
Provide oversight and advice by reviewing security designs and implementations
Coach developers on secure coding and provide actionable feedback
Build reusable standards, playbooks and onboarding materials
Communicate application risk to engineering teams, business partners and senior leadership
Set AppSec technical direction, mentor engineers and serve as escalation point for complex application-security problems

Requirements

What you’ll need

Bachelor’s degree in computer science, Information Security, MIS or an equivalent technical discipline
Significant hands-on application security experience at a senior or lead level, in an enterprise environment
Deep practical experience with SAST, SCA, secrets scanning and container/IaC scanning, including tuning, false-positive management and developer-facing triage
Proven experience integrating security into CI/CD pipelines and defining risk-based release gates
Strong threat modeling and secure design review capability (e.g. STRIDE), including authentication and authorization architecture
Working knowledge of OWASP Top 10 and secure coding practice across modern web and API stacks
Cloud security depth in Azure and/or AWS as it applies to application workloads and boundaries
Ability to script and automate using Python or comparable technologies
Experience defining and evidencing technical controls for external audit or penetration test
Excellent written and verbal communication; credibility with developers and executive audiences
Desirable: Direct experience supporting a FedRAMP or GovRAMP authorization from the application side
Desirable: Familiarity with UK Cyber Essentials Plus/NCSC Secure Design Principles, EU GDPR and NIS2, China MLPS/PIPL, Saudi NCA ECC, and Australia ASD Essential Eight
Desirable: Experience with vulnerability aggregation and posture-management platforms such as ArmorCode or Wiz
Desirable: Software development background and ability to review code credibly
Desirable: Experience running developer security enablement or training programs
Desirable: Prior experience mentoring engineers or leading a small technical function
Desirable: Comfort operating in an agile environment with multiple concurrent regulatory deadlines
Desirable: Professional accreditation such as CISSP, CSSLP, CCSP or equivalent

Benefits

Comp & perks

Eligible to participate in an annual incentive program
Benefits information provided by Pearson