[Remote] Sr Application Security Engineer

Note: The job is a remote job and is open to candidates in USA. Nelnet Business Solutions, a division of Nelnet, provides payment technology and education services to educational institutions, schools, students, families, and supporters. The Senior Application Security Engineer will lead hands-on application security testing, secure code review, threat modeling, and secure SDLC enablement while partnering with engineering, cloud, and product teams to reduce security risks and scale application security practices.

Responsibilities

• Lead manual source code review across priority applications, with emphasis on business logic, access-control, authentication, authorization, and data-protection risks
• Perform and guide application security testing using SAST, DAST, SCA, container scanning, secrets detection, and web/API testing methodologies
• Expand and support the Security Champions program through enablement, coaching, secure coding guidance, and practical developer resources
• Develop and improve automated source code review processes and CI/CD security checks to help scale consistent application security coverage
• Partner with engineering, cloud, and product teams to embed secure SDLC practices into design, development, testing, release, and production support activities
• Create clear vulnerability reports that explain risk, business impact, urgency, and recommended remediation steps for technical and non-technical audiences
• Evaluate and apply AI-assisted tooling to accelerate code review, testing, triage, reporting, and secure development workflows
• Advise teams on threat modeling for web, API, mobile, cloud, and AI-enabled application designs

Skills

• * Bachelor's degree in Computer Science, Cybersecurity, Information Technology, Software Engineering, or a related field; or equivalent combination of education and relevant experience
• * 5-7+ years of hands-on application security, software security, or secure software engineering experience
• * Experience integrating security tooling and automated checks into CI/CD pipelines
• * Familiarity and experience conducting secure code review and testing web/API applications using OWASP Top 10 and web testing methodologies
• * Experience effectively assessing, prioritizing, documenting, and communicating vulnerabilities and risk-based remediation guidance to management and engineering audiences
• * Experience with technical report writing and communication
• To be considered, candidates must already be authorized to work in the United States without the need for current or future sponsorship
• * Advanced degree or specialized training in application security, cybersecurity, software engineering, cloud security, or related technical discipline
• * Experience with AI/LLM-integrated applications, AI security tooling, mobile security, reverse engineering, or advanced application security certifications

Benefits

• Medical insurance
• Dental insurance
• Vision insurance
• Health Savings Account (HSA)
• Flexible Spending Account (FSA)
• Generous earned time off
• 401(k)
• Student loan repayment
• Life insurance
• AD&D insurance
• Employee assistance program
• Employee stock purchase program
• Tuition reimbursement
• Performance-based incentive pay
• Short-term disability
• Long-term disability
• Robust wellness program
• Hybrid work option for associates living within 30 miles of an office location, allowing remote work for part of the week while working in-office three days per week

Company Overview