Application Security Engineer

Job Description Summary

This role supports the security of the company’s applications, APIs, and web platforms by identifying and helping remediate vulnerabilities. The Application Security Engineer works closely with senior security and engineering teams to perform security testing, assist with secure coding practices, and contribute to DevSecOps initiatives.

Job Overview

Callaway is seeking an Application Security Engineer to assist in securing applications across modern cloud and web environments. This position focuses on learning and applying application security principles throughout the software development lifecycle, including code analysis, vulnerability scanning, and supporting runtime protections.

The ideal candidate is eager to grow in application security, has foundational knowledge of secure development practices, and enjoys collaborating with developers to improve security posture.

Roles and Responsibilities

• Assist in implementing and maintaining application security controls across cloud-based environments (Azure)
• Support integration and usage of GitHub Advanced Security (CodeQL, Dependabot, Secret Scanning)
• Perform basic secure code reviews and identify common security issues
• Run and monitor vulnerability scans (DAST/SAST) using tools such as Tenable
• Help triage and track application and API vulnerabilities, working with teams on remediation
• Assist with configuring CDN/WAF protections (Cloudflare, Vercel) such as rate limiting and basic rules
• Support efforts to protect applications from common threats (OWASP Top 10)
• Help monitor security logs and events in SIEM platforms (e.g., Sumo Logic)
• Assist in identifying suspicious activity such as anomalous authentication or API misuse
• Collaborate with development and DevOps teams to support secure CI/CD pipeline practices
• Support secure configuration of Azure services (Key Vault, API Management, Entra ID)
• Participate in automation efforts for security checks and policies
• Contribute to documentation, standards, and secure coding guidelines

Technical Competencies (Knowledge, Skills & Abilities)

• Basic understanding of application security concepts (OWASP Top 10 preferred)
• Familiarity with at least one programming or scripting language (e.g., JavaScript, Python, or Java)
• Exposure to application security tools (SAST/DAST tools such as GitHub Advanced Security, Tenable, etc.)
• Basic knowledge of web technologies (HTTP, APIs, REST)
• Familiarity with authentication concepts (OAuth2, OIDC, JWT) is a plus
• Understanding of cloud fundamentals (Azure or similar platforms)
• Awareness of CI/CD pipelines (GitHub, Azure DevOps)
• Strong problem-solving skills and willingness to learn
• Good communication and collaboration skills

Education & Experience

• 2–5 years of experience in Application Security, Software Development, Cybersecurity, or a related field
• Bachelor’s degree in Computer Science, Information Security, or related discipline, or equivalent practical experience
• Exposure or coursework in:
• Secure coding practices
• Web application security
• Cloud platforms (Azure preferred)
• Internship, labs, bug bounty participation, or personal projects in security are a plus
• Entry-level certifications are a plus (e.g., Security+, eJPT, AZ-900)