Application security and adjacent roles only. Each listing links to the original posting.
64 open roles. Updated October 16, 2026.
Newest 50 of 64 roles
Citi
“Citi emphasizes "shifting left"and automated testing in the software lifecycle.”
Cencora
“Embed security into the software development lifecycle by integrating security controls and automated scanning...”
MUFG
“Participates from early stages of systems planning and design, with a focus on threat intelligence and centralized...”
TD Bank
Wolters Kluwer
“Wolters Kluwer follows a shift-left approach to application security that enables teams to identify and address...”
TD Bank
GEICO
“'Protect security, privacy and integrity of customer and associate data & systems'.”
CACI International Inc
“- "Security is at the core of everything we do."”
Thales
“Thales's application security philosophy, influenced by its Imperva acquisition, emphasizes the critical importance of...”
Kyndryl
“Kyndryl's Application Security philosophy is centered on a "security-by-design and zero-trust approach" (Self-Reported).”
Atos
“"embeds security into every stage of your software development lifecycle (SDLC).”
CGI
Qualys
“Embedding security early and continuously in the development lifecycle, fostering DevSecOps collaboration, and...”
M&T Bank
“M&T Bank's Application Security (AppSec) mission involves "capturing and refining information security requirements".”
FNZ
“'Embed compliance, resilience, and security by design.”
Deloitte
“"Makes security consumable to the business." - Developer Enablement vs.”
SMBC Group
“SMBC Group views cybersecurity risks as a top management concern.”
U.S. Bank
Wells Fargo
“Stated AppSec mission / SSDLC emphasis: • "Drive continuous improvement in Secure SDLC Requirements"– Wells Fargo Jobs...”
Salesforce
“'Trust is the bedrock of our company.' They view cybersecurity as a 'shared responsibility' and aim to 'Build apps that...”
Lockheed Martin
“"Cyber is at the heart of everything we do." "Secure coding begins by identifying and addressing security threats"”
BNP Paribas
“Our role is to ensure the ongoing security of the Bank's systems and applications used by our customers.”
ECS
“ECS emphasizes an "invisible zero trust" approach that shifts the burden of verification from users to infrastructure.”
Barracuda
“A 'developer-focused mindset' and the integration of security directly into the engineering workflow rather than acting...”
ECS
“ECS emphasizes an "invisible zero trust" approach that shifts the burden of verification from users to infrastructure.”
Salesforce
“'Trust is the bedrock of our company.' They view cybersecurity as a 'shared responsibility' and aim to 'Build apps that...”
Scientific Research Corporation
“Broad cyber programs and capabilities, including vulnerability assessments and information assurance.”
State Street
“Integrating cybersecurity into agile practices and DevSecOps strategies.”
U.S. Bank
Genesys
“Genesys publicly states a secure-by-design, SDLC-integrated approach with threat modeling, peer code reviews, OWASP...”
Siemens
“Security becomes a default part of products, processes and organizations.”
MUFG
“Participates from early stages of systems planning and design, with a focus on threat intelligence and centralized...”
Siemens
“Security becomes a default part of products, processes and organizations.”
Salesforce
“'Trust is the bedrock of our company.' They view cybersecurity as a 'shared responsibility' and aim to 'Build apps that...”
Salesforce
“'Trust is the bedrock of our company.' They view cybersecurity as a 'shared responsibility' and aim to 'Build apps that...”
Navy Federal Credit Union
“"Our responsibilities include incident detection and response, penetration testing, application...”
Deutsche Bank
“Deutsche Bank publicly frames AppSec around a zero‑trust, threat‑driven posture focused on protecting confidentiality,...”
TD Bank
CGI
Grant Thornton (US)
“Grant Thornton (US) emphasizes securing the Software Development Life Cycle (SDLC) and integrating security and testing...”
Leidos
“Leidos' Application Security philosophy is centered on the principle that 'cyber must be designed into systems from the...”
Deutsche Bank
“Deutsche Bank publicly frames AppSec around a zero‑trust, threat‑driven posture focused on protecting confidentiality,...”
Ivanti
Swift
“Help financial institutions ensure their defences. The company's oversight objectives focus on risk identification,...”
Tesla
“Tesla values the work done by security researchers in improving the security of their products and service offerings,...”
LiveRamp
FICO
“FICO's AppSec philosophy is guided by a "security by design"principle and a proactive, risk-based approach.”
GEICO
“'Protect security, privacy and integrity of customer and associate data & systems'.”
Thales
“Thales's application security philosophy, influenced by its Imperva acquisition, emphasizes the critical importance of...”
GEICO
“'Protect security, privacy and integrity of customer and associate data & systems'.”
Offensive security teams attack systems, with permission, to find weaknesses before someone else does. In-house teams test their own company; consultancies test their clients'. Penetration testers run scoped tests against web applications, APIs, mobile apps and networks, then write up findings with steps to reproduce and fix them. Red team operators run longer campaigns that test detection and response as well as the technology.
Postings here ask for hands-on testing experience and the ability to write a clear report. Certifications such as OSCP, OSWE or GPEN come up often, and listings generally accept equivalent experience instead. Some titles on this page are AI red team roles, a newer specialty that tests models and AI features for misuse.