Application Security Engineer

Your Job

As the Application Security Engineer, you will be dedicated to strengthening and expanding our application security posture.

You will collaborate closely with development, engineering, product, and other teams during every stage of the software development lifecycle (SDLC), and your insights will influence broader security initiatives throughout the organization.

Within the GP Cyber Security Organization, this position is crucial in shaping the future of security at Georgia-Pacific.

You will be part of a larger team comprised of Vulnerability Management, Security Operations, Application Security, and GRC capabilities.

This role is based in Atlanta, GA at the GP HQ on Peachtree St.

Expectation is three days in office per week.

Our Team

The Application Security team within GP Cyber Security is focused on reducing risk across the software development lifecycle by embedding secure development practices, operating our application security testing platforms, and driving vulnerability remediation.

We partner closely with development, engineering, and product teams to deliver risk-based insights that enable secure, profitable business decisions.

The team manages and tunes our application security tooling and collaborates with stakeholders onboarding applications into those tools to identify vulnerabilities and drive timely remediation across the enterprise.

What You Will Do


* Partner with development teams to embed security standards and best practices into their work processes


* Identify web application vulnerabilities, prioritize and risk-adjust findings, consult on mitigation strategies, and ensure timely resolution


* Demonstrate self-motivation and direction while applying strong organizational and project management skills to plan, execute, and complete tasks in a timely and efficient manner


* Design and deliver training sessions for developers and stakeholders on secure coding practices, threat modeling, and risk assessment


* Mature our Application Security Testing (GHAS/Orca) platforms, collaborating with developers to address findings and minimize false positives


* Lead proactive code reviews to pinpoint vulnerabilities while refining and incorporating the Secure Development Lifecycle into our engineering processes


* Offer specialized application security guidance on projects, system issues, and in stakeholder meetings, including guidance on relevant industry standards and practices such as OWASP and CIS


* Assist in developing and maintaining an ongoing security assurance program, including appropriate scripts and monitoring capabilities to verify security effectiveness, analyze data, develop trend analysis, and ensure compliance with existing standards, policies, and procedures


* Conduct technical security risk assessments with internal and external resources as needed

Who You Are (Basic Qualifications)


* Experience testing and identifying vulnerabilities in web applications tha...