Senior Information Security Engineer - Appsec

Sonatype is the software supply chain security company. We provide the world’s best end-to-end software supply chain security solution, combining the only proactive protection against malicious open source, the only enterprise grade SBOM management and the leading open source dependency management platform. This empowers enterprises to create and maintain secure, quality, and innovative software at scale.

As founders of Nexus Repository and stewards of Maven Central, the world’s largest repository of Java open-source software, we are software pioneers and our open source expertise is unmatched. We empower innovation with an unparalleled commitment to build faster, safer software and harness AI and data intelligence to mitigate risk, maximize efficiencies, and drive powerful software development.

More than 2,000 organizations, including 70% of the Fortune 100 and 15 million software developers, rely on Sonatype to optimize their software supply chains.

About the Role:
• We are seeking a skilled Senior Information Security Engineer to join our Application Security team. In this role, you will partner with engineering, product, and infrastructure teams to embed security into the software development lifecycle, improve our application security posture, and support the broader security program. This is a hands-on role with significant impact, ideal for someone who enjoys both technical depth and cross-functional collaboration in a small, agile security team.

Key Responsibilities:
• Application Security & Engineering Enablement
• Run and maintain SAST, SCA, and DAST tooling, tuning results for accuracy.
• Validate vulnerabilities and create actionable remediation tickets.
• Partner with developers to drive remediation and provide secure coding guidance.
• Conduct product security reviews, ad-hoc threat modeling, and architecture assessments.

• Vulnerability & Incident Management
• Support vulnerability triage, including bug bounty submissions.
• Collaborate on remediation plans and track closure through completion.
• Participate in security event and incident response as needed.

• Analytics & Program Support
• Assist with InfoSec projects and contribute to the evaluation, configuration, and automation of security tools.

What We’re Looking For:
• 5+ years of experience in application security engineering, security operations, or software development.
• Strong hands-on experience with software development (ability to read, write, and review code).
• Proficiency in at least one modern programming language (e.g., Java, JavaScript/TypeScript, or Python).
• Strong understanding of modern application security concepts (e.g., OWASP Top 10, secure SDLC).
• Hands-on experience with SAST, SCA, and DAST tools.
• Experience in DevSec practices and integrating security into CI/CD pipelines.
• Experience working cross-functionally with engineering teams to resolve vulnerabilities.
• Ability to conduct technical risk assessments of applications, integrations, and third-party tools.

How You Work:
• Excellent written and verbal communication skills in English.
• Able to clearly articulate technical concepts to both technical and non-technical stakeholders.
• Practices active listening and gives/receives feedback constructively.
• Works effectively in a distributed or asynchronous team environment.
• Self-starter with the ability to think independently and drive work forward with minimal guidance.

Bonus Skills (Good to Have):
• Knowledge of cloud and infrastructure security principles. (AWS)
• Familiarity with infrastructure security and containerized workloads.
• Experience in incident response and security event handling.
• Relevant certifications such as:
• SANS Certifications: GSEC, GCIH, GCLD, GCID, GMON
• (ISC)² Certifications: CISSP, CC, SSCP, CCSP, CAP, CSSL
• Deliver secure coding training and resources tailored to engineering teams.

Why Join Us?:
• Work with a global team at the forefront of cybersecurity.
• Exciting career growth opportunities with industry-leading experts.
• Work-from-home flexibility with a strong work-life balance.
• Continuous learning & certification support to advance your skills.

f you're passionate about cybersecurity and ready to take on challenging security projects, we’d love to hear from you! 🚀

At Sonatype, we value diversity and inclusivity. We offer perks such as parental leave, diversity and inclusion working groups, and flexible working practices to allow our employees to show up as their whole selves. We are an equal-opportunity employer, and we do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status. If you have a disability or special need that requires accommodation, please do not hesitate to let us know.