6+ years experienceAWSAzureGCPPythonJavaScript/TypeScript
About This Role
We are seeking an Application Security Engineer-II to help embed security within Company's software development lifecycle and scale our product security practices.
Design and implement security tooling and automation in CI/CD pipelines (SAST, secrets scanning, dependency checks, IaC scanning) to integrate security at build-time
Conduct security assessments of web apps, APIs, cloud-native services, and internal tooling using manual and automated approaches
Lead and facilitate threat modeling for critical features and systems, and drive mitigation strategies with engineering teams
Collaborate on application security design, providing guidance on authentication, authorization, encryption, input validation, error handling, and data protection
Evaluate the security maturity of products, identify gaps, and partner with engineering to close them
Partner with InfoSec to support customer security questionnaires, audits, and external security posture communications
Promote secure coding practices and define reusable secure patterns, golden paths, and developer guides
Support and enable Security Champions across squads through mentorship, training, and playbooks
Work with CloudOps on runtime guardrails, including secrets management, identity controls, and logging practices
Assist in security incident investigations related to application-layer vulnerabilities and support remediation planning
Deliver security awareness sessions and workshops to uplift team security knowledge
Stay up to date on security trends, tools, and best practices, and share knowledge with engineering teams
6+ years experience in application security or DevSecOps roles
Solid understanding of web application security (e.g., OWASP Top 10, ASVS) and common vulnerabilities
Hands-on experience with security tooling in CI/CD pipelines (e.g., SAST, SCA, secrets scanning, IaC scanning)
Experience in secure architecture, threat modeling, and design reviews
Proficiency with a modern programming language (Python, TypeScript, JavaScript, or similar)
Strong communication skills, able to collaborate effectively across engineering, CloudOps, and InfoSec teams
Bonus: Experience supporting data security initiatives or customer security assessments
Bonus: Familiarity with cloud-native environments (AWS, GCP, Azure)
Benefits & Perks
Award-winning workplace
Inclusion-first work culture
Commitment to employee growth and development: iGrow program
Employee resource groups: iBelong program
Paid internships, co-op and apprenticeships
Generous and flexible paid time off
About Itron, Inc.
Itron, Inc. is an American technology company founded in 1977 and based in Liberty Lake, Washington. The company specializes in energy and water resource management solutions, focusing on efficient utility meter reading technologies. Itron offers a wide range of products, including electricity, gas, and water meters, as well as advanced metering infrastructure and smart grid communication systems. Itron provides various services, such as consulting for energy efficiency and demand response programs, installation of metering infrastructure, and managed services to support utility operations. The company serves a global customer base, primarily utilities and municipalities, and is involved in smart grid modernization and smart city initiatives. Itron has expanded its reach internationally and has formed partnerships for smart metering projects in regions like Fiji and Europe. With a strong presence in the market, Itron employs over 5,000 people and is recognized for its contributions to clean energy manufacturing and innovation.
Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.
3 Intel Signals
Security Philosophy
Itron states a strong commitment to security, asserting they care about it even more than their customers, and that their security framework is integrated throughout all business aspects.
They define and implement application security metrics in alignment with each application's business objectives.
Security Team
Itron supports and enables Security Champions across squads. Andrew Pendray is a Sr. Product Manager involved with security in AMI 2.0.
Key Initiatives
Itron conducts security training for developers and operates a vulnerability disclosure program for security issues found in its products and services.
Their development process includes automated tests and SAST for new artifacts, and all deployments to pre-production or production environments require secondary approval.
They define and implement application security metrics aligned with business objectives, tracking vulnerabilities by detection source (design review, code review, SAST, DAST, penetration test, VDP, or bug bounty).
The company designs and implements security tooling and automation in CI/CD pipelines, supports Security Champions across squads, and leads threat modeling for critical features and systems. They also focus on security in AMI 2.0, noting that AMI 2.0 meters are full-blown computers with Linux container environments.
Preparing for an AppSec interview?
Get the weekly briefing 2,000+ security pros trust.
