Application Security Engineer

Atlanta, GAPosted 1 month agoWebsite

Apply on Georgia-Pacific LLC's site →

At a Glance

AWSAzurePythonJavaJavaScript/TypeScriptGo

Full details on LinkedIn

The complete job description, requirements, and application details are available on the original posting.

About Georgia-Pacific LLC

Georgia-Pacific LLC is a prominent American pulp and paper company based in Atlanta, Georgia. Founded in 1927, it has grown to become one of the largest manufacturers and distributors of tissue, pulp, paper, packaging, and building products. As a subsidiary of Koch Industries since 2005, Georgia-Pacific operates over 180 locations across North America, South America, and Europe, employing around 30,000 people. The company’s operations are organized into four main segments: Consumer Products, Packaging, Bleached Pulp and Paper, and Building Products. In Consumer Products, Georgia-Pacific offers a variety of household and professional paper goods, including well-known brands like Angel Soft and Brawny. The Packaging segment focuses on paper-based materials and industrial papers. In the Building Products segment, the company supplies construction materials such as gypsum wallboard and plywood. Additionally, Georgia-Pacific Recycling is a major player in the recycling of paper, metal, and plastics, emphasizing efficient resource use and environmentally responsible practices.

Employees

30,000

1662 engineers

Website

Visit →

Security at Georgia-Pacific LLC

Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.

3 Intel Signals

Security Philosophy

Mission and priorities: The stated AppSec purpose is to reduce risk across the SDLC by embedding secure-development practices, operating application-security testing platforms and driving vulnerability remediation.
The team frames its output as risk-based insight for secure, profitable business decisions.
Developer enablement versus gatekeeping: Public role material describes partnering with development teams, embedding standards in work processes, training developers and stakeholders, conducting proactive code reviews and influencing without direct authority.
No public statement requiring universal AppSec sign-off or describing a strict release gate was found.
Risk philosophy: The stated practices are risk-adjusting and business-contextual: identify vulnerabilities, prioritize findings, consult on mitigations, assess technical risk and connect cyber-risk decisions to business outcomes.
Stuart Yearout's external leadership article describes informed risk-taking and business context as central to threat management.
Pain points and goals: Public statements identify the vulnerability backlog, the risk of chasing volume metrics, the need to minimize false positives, the need to mature GHAS/Orca platforms, and the need for security assurance, monitoring, trend analysis and timely remediation.
Gaps: No standalone GP AppSec mission statement, published AppSec metrics, formal developer-security service catalog or public release-gating policy was found.
No contradiction was located between the employer posting and the public leadership statements.

Security Team

Section 2 — The AppSec Team: People & Structure Org structure: Application Security sits within GP Cyber Security alongside Vulnerability Management, Security Operations and GRC.
The team works with development, engineering and product teams throughout the SDLC.
Publicly identified personnel: • Stuart Yearout — Director, Cyber Security.
His profile states that he oversees GRC, Application Security and IT/OT Cyber capabilities. • Garrison LeRock — Application Security Lead.
His profile states that he leads security engineers, owns the enterprise AppSec program, oversees the security champion program and runs monthly developer AppSec office hours. • Siddhant Singh — Cyber Security Engineer.
His profile states that he reports to the CISO and led a company-wide AppSec program.
Reporting line: A CISO reporting relationship is publicly stated for Singh.
The Application Security Engineer posting does not state the AppSec team's full reporting chain.
Three relevant public profiles were identified, but they do not establish total team size.
Active AppSec postings as of: 1 explicitly AppSec-specific posting — Application Security Engineer, job 193403, Atlanta.
The keyword results page returned three total results, but two were unrelated architecture or IT roles.
Common skill and workflow patterns: SAST, SCA and DAST analysis.
GHAS/Orca administration.
False-positive reduction.
Vulnerability prioritization and remediation.
Secure coding and threat-modeling training.
Proactive code review.
CI/CD, containers, microservices and infrastructure-as-code.
AWS/Azure security.
Scripting and security reporting. Gaps: No public AppSec headcount, formal organization chart or complete reporting chain was found.

Key Initiatives

Security Champions Program: Evidence Found.
Garrison LeRock's current profile states that he oversees the security champion program and monthly developer AppSec office hours.
Shift left in practice: The employer posting describes secure-development practices across every SDLC stage, application onboarding into testing platforms, developer collaboration, proactive code reviews and CI/CD-oriented development practices.
Vulnerability-management process: • Intake and discovery: Application-security testing platforms, application onboarding, proactive code review and vulnerability identification are publicly stated sources. • Triage and remediation: Findings are identified, prioritized, risk-adjusted and mapped to mitigation strategies.
The role is responsible for timely resolution.
The public record also identifies collaboration with developers to address findings and minimize false positives.
Secure SDLC artifacts and ceremonies: Developer training on secure coding, threat modeling and risk assessment.
Proactive code reviews.
Security standards and best practices.
Technical security risk assessments.
An ongoing security-assurance program.
Scripts and monitoring to verify effectiveness.
Guidance aligned to OWASP and CIS.
Recent initiatives visible within the last six months: The current public professional-profile record, refreshed, reports security champions, monthly developer AppSec office hours and contribution to an AI-security strategy.
The current Application Security Engineer role calls for maturation of GHAS/Orca platforms, false-positive reduction, secure-development integration and timely remediation.
Gaps: No public AppSec policy, security-champion charter, vulnerability SLA, remediation dashboard, bug-bounty intake description or penetration-testing schedule was found.

Preparing for an AppSec interview?

Get the weekly briefing 2,000+ security pros trust.

Interested in this role?

Apply on Georgia-Pacific LLC's site