Senior Application Security Engineer
About this role
Verisign needs a senior engineer to secure all software built and used by the company, including applications that embed large language models or other artificial intelligence services. The incoming specialist will act as a subject matter expert, guiding development teams through requirement, design, and architecture phases while establishing long-term program standards.
Daily work involves performing manual and automated vulnerability assessments, managing the vulnerability lifecycle across multiple security toolchains, and evaluating third-party vendor applications. The person in this role will also assess AI risks such as prompt injection and sensitive data exposure, pilot AI-assisted capabilities within security workflows, and mentor junior engineers and analysts.
Ideal candidates bring deep technical leadership in application security, strong interpersonal skills, and familiarity with emerging artificial intelligence security risks. Someone who works well independently, communicates effectively with technical and non-technical audiences, and stays current with industry research will thrive in this hybrid environment based in Reston, Virginia.
What you will do
- Serve as the primary application security subject matter expert for development teams during the requirement, design, and architecture phases.
- Conduct and lead manual and automated application vulnerability assessments while providing clear remediation guidance to engineering teams.
- Manage the vulnerability management lifecycle across static analysis, dynamic testing, interactive testing, software composition analysis, and secrets scanning tools.
- Review submissions from the public bug bounty program and track open issues against defined service-level agreements.
- Provide guidance for integrating security testing into continuous integration and continuous deployment pipelines.
- Assess applications embedding large language models or other AI services for risks like prompt injection and insecure output handling.
- Develop internal guidance for developers using AI coding assistants and evaluate AI-assisted capabilities within the security workflow.
What you need
- Ten or more years of experience in information technology, which must include hands-on application development.
- Six or more years of experience conducting application security assessments using commercial off-the-shelf and open-source tooling.
- Hands-on experience with software composition analysis, dynamic application security testing, and secrets scanning platforms.
- Experience running a vulnerability management program through ticketing and workflow systems, including service-level agreement definition and executive reporting.
- Strong working knowledge of the OWASP Testing Framework and the OWASP Top 10.
- Practical familiarity with artificial intelligence and large language model application security risks and current industry guidance.
- Excellent communication, presentation, and leadership skills for engaging with senior technical and non-technical audiences.
Nice to have
- Six or more years of software development using Java, C++, Rust, Go, Python, or Perl
- Experience implementing security assessments within a continuous integration pipeline
- Advanced experience with Linux operating systems and command-line work
- Understanding of Agile methodologies and DevOps security integration
- Experience running or supporting a public or private bug bounty program
Benefits
- Discretionary bonus based on individual and company performance
- Discretionary stock awards for eligible roles
Skills and tech stack
Questions candidates ask
What is the work location and remote policy for this role?
This position is based in the Reston, Virginia office and offers a hybrid work schedule.
What is the salary range for the Senior Application Security Engineer?
The anticipated annual base salary range is $164,300 to $222,300, though base pay offered may vary depending on job-related knowledge, skills, and experience.
What kind of artificial intelligence security tasks are involved?
The engineer will assess applications embedding large language models or other AI services for risks like prompt injection, sensitive data exposure, and over-permissioned agents, while also developing internal guidance for developers using AI coding assistants.
What additional compensation might be available beyond base salary?
Verisign offers a discretionary bonus based on individual and company performance, and certain roles may be eligible for discretionary stock awards.