Edtech.com's Summary

PowerSchool is hiring a Senior Application Security Engineer. The role builds security into the software development lifecycle for PowerSchool's products and services, partnering with engineering, architecture, product, and DevOps teams on threat modeling, secure design reviews, and application security testing. It reports to the Senior Manager of Product Security and acts as a trusted advisor to development teams.

Highlights

Perform threat modeling and secure architecture and design reviews for new and existing applications to find attack vectors and weaknesses early in development.
Manage and support application security testing programs, including SAST, DAST, software composition analysis, and secret scanning, and validate and prioritize the findings for development teams.
Work with engineering teams on remediation plans, track security issues through resolution, and review penetration test findings with Offensive Security Engineers to drive corrective actions.
Develop security requirements, patterns, and implementation guidance for web applications, APIs, and cloud-native applications.
Evaluate third-party components and open-source dependencies for supply chain risk and support software bill of materials (SBOM) initiatives.
Deliver application security training and developer enablement, and support security champion programs within engineering.
Establish and improve application security standards, secure coding requirements, and secure development lifecycle processes.
Bring 5+ years of experience in application security, software security, or DevSecOps, with a bachelor's degree in a related field or equivalent experience.
Know how to find and mitigate OWASP Top 10 and API Security vulnerabilities, and understand authentication, session management, cryptography, CI/CD pipelines, and AWS or Azure security.
Preferred: experience in a mature Product Security or DevSecOps program, manual secure code review, container and Kubernetes security, and certifications such as CISSP, CSSLP, OSWE, or AWS Security Specialty.

Senior Application Security Engineer Full Description

Overview:

About PowerSchool

At PowerSchool, we power education for students around the world. As the global leader in cloud-based K-12 software, we support the full education ecosystem—from the central office to the classroom to the home. Joining PowerSchool means being part of a mission-driven team that is transforming K-12 education by helping schools operate more effectively and deliver better outcomes for educators, students, and families.

Job Overview

The Application Security Engineer is responsible for integrating security throughout the software development lifecycle to reduce risk and improve the security of PowerSchool's products and services. Reporting to the Senior Manager of Product Security, this role partners closely with engineering, architecture, product, and DevOps teams to identify security requirements, perform threat modeling, conduct secure design reviews, manage application security testing programs, and guide remediation efforts. The Application Security Engineer serves as a trusted advisor to development teams, helping ensure that security is built into applications from design through deployment while supporting secure development practices, developer education, and continuous improvement of the organization's product security program. Responsibilities:

Description

As an application security engineer, you are responsible for identifying potential threats and vulnerabilities in applications, designing secure software systems, and implementing robust security measures. Your day-to-day job will consist of:

Partner with development, architecture, product, and DevOps teams to integrate security throughout the software development lifecycle.
Perform threat modeling exercises to identify potential attack vectors, security risks, and required security controls for new and existing applications.
Conduct secure architecture and design reviews to identify security weaknesses and recommend effective mitigations early in the development process.
Provide security guidance and consultation to engineering teams regarding secure coding practices, application security risks, and security requirements.
Manage and support application security testing programs, including static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), secret scanning, and related security technologies.
Analyze, validate, prioritize, and communicate application security findings to development teams and other stakeholders.
Work with engineering teams to develop remediation plans and track security issues through resolution.
Establish, maintain, and continuously improve application security standards, secure coding requirements, and secure development lifecycle processes.
Evaluate third-party software components, open-source dependencies, and software supply chain risks to identify potential security concerns.
Support software bill of materials (SBOM) initiatives and software supply chain security activities.
Develop security requirements, security patterns, and implementation guidance for web applications, APIs, cloud-native applications, and supporting services.
Collaborate with Offensive Security Engineers to review penetration test findings and drive corrective actions where appropriate.
Design and deliver application security training, awareness materials, and developer enablement programs.
Support security champions and other security advocate programs within engineering organizations.

Qualifications:
Minimum Qualifications

5+ years of experience in application security, software security, secure software development, DevSecOps, software engineering, or a related discipline.
Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Software Engineering, or a related field; or equivalent combination of education, training, and experience.
Experience performing threat modeling, secure design reviews, and application security assessments.
Experience identifying and mitigating common web application and API vulnerabilities, including those described by the OWASP Top 10 and OWASP API Security Top 10.
Experience supporting application security testing technologies, including SAST, DAST, SCA, secret scanning, and related security tooling.
Strong understanding of secure coding principles, software architecture, and secure development practices.
Knowledge of authentication, authorization, session management, cryptography, API security, and software supply chain security concepts.
Experience working with software development teams to remediate security findings and implement secure solutions.
Familiarity with modern software development methodologies, CI/CD pipelines, and DevOps practices.
Knowledge of cloud technologies and security concepts within AWS and/or Microsoft Azure environments.
Strong analytical, communication, presentation, and stakeholder management skills.
Ability to communicate technical security concepts effectively to developers, engineers, and business stakeholders.

Preferred Qualifications

Experience working within a SaaS, cloud-native, software development, or technology organization.
Experience serving as an application security engineer within a mature Product Security or DevSecOps program.
Experience with software development languages such as Java, C#, JavaScript, TypeScript, Python, Go, or similar technologies.
Experience developing secure development lifecycle (SDLC) processes, standards, and governance frameworks.
Experience conducting manual secure code reviews and identifying security weaknesses in application source code.
Experience supporting software supply chain security initiatives, including SBOM generation, dependency management, and open-source risk management.
Experience with container security, Kubernetes security, cloud-native application security, and API security.
Familiarity with threat intelligence, penetration testing, offensive security practices, and vulnerability management programs.
Experience implementing or supporting security champions programs and developer security training initiatives.
Familiarity with NIST Secure Software Development Framework (SSDF), OWASP SAMM, or similar software security frameworks.
Industry certifications such as CISSP, CSSLP, GWAPT, GWEB, OSWE, Security+, Azure Security Engineer Associate, AWS Security Specialty, or equivalent.

Compensation & Benefits:
Compensation & Benefits
Along with our highly market competitive base compensation, PowerSchool offers the following benefits:

Comprehensive Insurance Coverage (including Medical, Dental, Vision, Pharmacy benefits, Life Insurance and AD&D)
Flexible Spending Accounts and Health Savings Accounts
Short-Term Disability and Long-Term Disability
Comprehensive 401(k) plan
Generous Parental Leave
Unrestricted paid time off (known as Discretionary Time Off - DTO)
Wellness Program, including ClassPass & Employee Assistance Program
Tuition Reimbursement
Optional Benefits: Pet Insurance, Identity Theft Protection, Student Debt Repayment Program and Prepaid Legal coverage

EEO Commitment:

EEO Commitment

PowerSchool is committed to a diverse and inclusive workplace. PowerSchool is an equal opportunity employer and does not discriminate on the basis of race, national origin, gender, gender identity, sexual orientation, protected veteran status, disability, age, or other legally protected status. Our inclusive culture empowers PowerSchoolers to deliver the best results for our customers. We not only celebrate the diversity of our workforce, we celebrate the diverse ways we work. If you have a disability and need an accommodation regarding our recruiting process, please let us know by emailing [email protected].

Let me find your next job.

Thanks - you're signed up.

Senior Application Security Engineer

Edtech.com's Summary

Senior Application Security Engineer Full Description

Director, Information Security

Director, Information Security

IT Senior Manager

Information Security Professional II

Lead, Research Cybersecurity