Security Engineer, Application Security

Blue Cross Blue Shield Association (BCBSA)

Confirmed live yesterday High trust
Hybrid

Quick summary

Work type
Hybrid
Location
ChicagoWashington, DC
Salary
$118,500–$171,825 / yr
Employment
Full-time
Posted
14 days ago
Freshness
Confirmed live yesterday

Market check

Salary context

Below market

How this pay compares to similar roles

Similar $179k
This role $145k
$106k $232k
below market most similar roles pay here above market

This role pays less than 74% of similar roles. Most pay $145,000–$213,250 — the blue band above. At the midpoint, this role pays about $145k versus about $179k for comparable roles.

Based on 240 similar postings.

Employer

About Blue Cross Blue Shield Association (BCBSA)

The Blue Cross Blue Shield Association is a federation of 33 independent health insurance companies providing health coverage to millions of Americans through locally operated member plans. Industry: Health Insurance

Blue Cross Blue Shield Association (BCBSA) currently has 9 open roles on FindRole.

Listed pay typically runs $143,300–$207,800 across 9 roles with salary data.

Most-posted roles

View all roles at Blue Cross Blue Shield Association (BCBSA)

At a glance

TL;DR · Security Engineer, Application Security

The Security Engineer (Application Security) collaborates with architects and stakeholders to implement engineering guidance within a specific security domain. This role involves leading project roadmaps, driving cost optimization, and enhancing risk visibility through robust management frameworks. Day-to-day responsibilities include managing domain-specific security tools, participating in incident response, and overseeing the application vulnerability assessment lifecycle. The engineer integrates security controls into DevSecOps pipelines for cloud-native, web, API, containerized, and microservices-based applications. Key technologies include Azure, AWS, Kubernetes, OpenShift, Terraform, Bicep, and Docker. Required skills encompass SAST, DAST, SCA, threat modeling, and secure code reviews using tools like Burp Suite, Checkmarx, and Snyk. The role ensures compliance with HIPAA, HITRUST, and NIST frameworks while assessing code in Python, Java, JavaScript, and Go.

What does a Security Engineer earn?

Median $193000 from 106 postings across 42 companies.

See salary data

What you'll do

  • Lead the creation of comprehensive security roadmaps for various projects and departments.
  • Design and execute process improvement initiatives to champion operational excellence.
  • Identify and implement strategic savings opportunities to drive significant cost optimization.
  • Develop and oversee robust risk management frameworks to enhance security risk visibility.
  • Manage domain-specific security tools and maintain defined security architecture.
  • Execute application security engineering, assessments, and secure software development practices across cloud-native and containerized environments.
  • Manage the application vulnerability assessment cycle, including planning, validation, reporting, and remediation tracking.
  • Integrate security controls and testing throughout the software development lifecycle and DevSecOps pipelines.

What we're looking for

  • Bachelor's Degree in Computer Science, Information Security, or related field or equivalent work experience.
  • 5+ years of cybersecurity experience with a preferred focus on application security, vulnerability assessments, and secure software development.
  • Experience managing the Application Vulnerability Assessment cycle, including planning, validation, reporting, and remediation tracking.
  • Experience assessing cloud-native, web, API, containerized, and microservices-based applications across Azure, AWS, Kubernetes, and OpenShift.
  • Experience conducting SAST, DAST, SCA, SBOM analysis, API security assessments, secure code reviews, threat modeling, and risk assessments.
  • Experience with Infrastructure as Code technologies including Terraform, Bicep, ARM Templates, YAML, Docker, Kubernetes manifests, and Helm.
  • Proficiency with application security tools such as Burp Suite, OWASP ZAP, Checkmarx, Veracode, Fortify, GitHub Advanced Security, SonarQube, Postman, and SoapUI.
  • Demonstrates AI literacy and an understanding of generative AI tools, including appropriate business applications and limitations (preferred).

More like this

Similar roles

Application Security Engineer

State Street

Quincy, MA +4 59 days ago
DevSecOps AppSec CI/CD SAST DAST SCA Python Java .Net Node.js AWS Azure Kubernetes Terraform Ansible Infrastructure as Code Agile API Security Container Security SSDLC
6+ yrs exp

Application Security Engineer

Booz Allen Hamilton

Annapolis Junction, MD +1 39 days ago
Secure SDLC DevSecOps SAST DAST SCA IaC Scanning Kubernetes Containers Microservices API Security Threat Modeling SBOM Cryptography OWASP SAMM BSIMM NIST SSDF NIST CSF ISO 27001 MITRE ATT&CK Vulnerability Management Cloud Security Secrets Detection
5+ yrs exp

Information Security Engineer, Application Security

Lam Research

Fremont, CA 46 days ago $92,000–$211,000
Secure SDLC SAST DAST SCA Threat Modeling CI/CD OWASP MLOps Azure Kubernetes Git Bitbucket Jenkins Artifactory API Security Secrets Management Vulnerability Management Generative AI
3+ yrs exp Hybrid

Distinguished Engineer, Application Security

CVS Health

Remote (Arizona) 34 days ago $175,100–$334,750
Application Security SAST DAST SCA IAST RASP ASPM ASOC CI/CD Python Java Go TypeScript JavaScript C# Kubernetes GitHub Actions GitLab CI Jenkins Argo API Security Threat Modeling SBOM SLSA eBPF WAF GraphQL gRPC REST OWASP ASVS NIST SSDF HIPAA PCI DSS HITRUST Service Mesh
10+ yrs exp Remote

Application Security Engineer

State Street

Quincy, MA +3 90 days ago
Application Security DevSecOps Application Detection and Response SAST DAST SCA RASP WAAP API Security AWS Azure Kubernetes Terraform Ansible Python Java .NET Node.js CI/CD Infrastructure as Code OWASP Top 10 Incident Response Agile
6+ yrs exp

Staff Application Security Engineer, Threat Research

CVS Health

New York, NY 7 days ago $106,605–$284,280
Application Security Threat Modeling Vulnerability Analysis AWS Azure Google Cloud Platform Docker Kubernetes Infrastructure as Code CI/CD DevSecOps Python Java JavaScript C# C/C++ PowerShell Shell Scripting Web Application Firewall API Security Snowflake HIPAA HITRUST PCI DSS NIST CSA
7+ yrs exp Hybrid