Lead Cybersecurity Application Security Engineer Dynamic, Runtime & API Security

This position requires office presence of a minimum of 5 days per week and is only located in the location(s) posted. No relocation is offered.

Join AT&T and reimagine the communications and technologies that connect the world. Our Chief Security Office ensures that our assets are safeguarded through truthful transparency enforce accountability and master cybersecurity to stay ahead of threats. Bring your bold ideas and fearless risk-taking to redefine connectivity and transform how the world shares stories and experiences that matter. When you step into a career with AT&T you wont just imagine the future-youll create it.

We are seeking an Application Security Engineer to strengthen the security of our applications and APIs through a combination of dynamic application security testing (DAST) runtime application self-protection (RASP) and API security engineering. This is an application security engineering role not a traditional security operations position.

The ideal candidate is a security-minded engineer with strong hands-on experience in web application and API security who understands modern application attacks and can translate that understanding into practical testing protection and remediation strategies. This role sits at the intersection of AppSec engineering and production defense with responsibility for identifying exploitable vulnerabilities both before deployment and while applications are running in production reducing risk from active attacks misuse and exposed application behavior.

This candidate will also evaluate and implement AI-assisted security capabilities to improve coverage prioritization and speed such as intelligent scan orchestration alert triage anomaly detection for API abuse and developer-facing remediation guidance while ensuring results are valid measurable explainable and safe for production use.

Job Summary:

You will own and scale dynamic security capabilities across theSoftware Delivery Lifecycle (SDLC)and production with a strong emphasis on:

• DAST automationand integration into CI/CD pipelines
• RASP and in-process runtime protection(e.g. JVM/.NET CLR instrumentation)
• API Security engineeringfor internal and external/internet-facing endpoints including edge/API gateway protections and continuous API discovery (shadow/zombie APIs)

This role is best suited for a candidate with anapplication security mindset first: someone who can assess real-world exploitability validate findings work directly with developers on durable remediation and build or extend automation in code when existing tooling does not fully solve the problem.

Youll partner closely with security teams platform teams and developers to define policy deploy controls safely tune security tool detections reduce false positives and measurably improve security outcomes.

Detailed Job Description:

This role focuses on active defense for web applications and APIs through a combination of security testing runtime instrumentation and API protection. The candidate will help design and mature security programs that combine:

• Dynamic application and API testing to identify exploitable vulnerabilities logic weaknesses and misconfigurations as early as possible
• Runtime protection and instrumentation via runtime security principals and tools such as RASP to detect and where appropriate block exploit attempts in production with an emphasis on protecting API traffic application workflows and business logic
• API security capabilities such as API gateway onboarding and policy enforcement abuse prevention (e.g. scraping/bots) technical reviews and deep-dives and continuous discovery of undocumented unmanaged or exposed APIs

Success in this role requires deep application security knowledge including web and API attack patterns authentication and authorization weaknesses exploitability analysis and vulnerability remediation as well as ability to script automate integrate and build lightweight solutions when commercial tooling is insufficient.

The right candidate will be comfortable moving between hands-on security testing technical analysis developer partnership and security engineering automation with a focus on reducing meaningful application risk.

Key Responsibilities:

AI-Assisted Security Engineering

• Identify practical opportunities to apply AI-assisted approaches across DAST API testing runtime telemetry and security workflows (e.g. prioritization correlation anomaly detection automated enrichment and remediation support).
• Implement AI-enabled workflows to reduce false positives improve triage efficiency and accelerate remediation (e.g. intelligent deduplication exploitability scoring and auto-generated developer guidance with human review).
• Partner with platform and engineering teams to integrate AI-assisted and automated security capabilities into pipelines and operational processes in a measurable repeatable and secure way.

DAST & Dynamic Testing (Scale and Automation)

• Own the DAST lifecycle including onboarding authenticated scanning scan orchestration environment readiness tuning and false-positive reduction.
• Integrate DAST and automated API testing into CI/CD pipelines using repeatable maintainable security-as-code patterns.
• Create standards and runbooks for scan profiles test data authentication/session handling and release readiness criteria.
• Perform triage and validate exploitability of findings distinguishing between theoretical issues and meaningful application risk.
• Translate findings into clear actionable developer remediation guidance and partner with teams to verify effective fixes.

API Security Engineering (Internet-Facing Gateway Discovery)

• Partner with API gateway and edge teams to implement and tune security controls such as schema/contract validation request filtering threat protections rate limiting and throttling.
• Drive API discovery and inventory capabilities to identify and govern shadow and zombie APIs and establish processes to bring them under security review and lifecycle management.
• Perform and automate security testing aligned to the OWASP API Security Top 10 including authorization failures such as BOLA/BFLA.
• Assess API exposure and abuse risk including authentication/authorization weaknesses object access patterns input validation issues data leakage and business logic abuse.
• Help implement protections against abuse of exposed endpoints including bot/automation defenses scraping prevention and volumetric misuse controls.

RASP & Runtime Active Defense (In-Process Instrumentation)

• Deploy configure and tune runtime security solutions (such as RASP) integrated into application runtimes (e.g. CLR) to monitor execution and defend against attacks in production.
• Establish safe rollout patterns (detect-only tuned detection selective enforcement) with guardrails to minimize performance impact and avoid breaking application behavior.
• Analyze runtime telemetry to identify attack patterns such as injection attempts exploitation chains abnormal access behavior and policy violations.
• Tune runtime protections based on observed application behavior and threat patterns with a focus on reducing exploitability while supporting development teams in achieving long-term remediation.
• Collaborate closely with developers and architects to ensure runtime protections complement rather than replace secure design and code-level fixes.

Security Engineering & Collaboration

• Build and maintain metrics that reflect meaningful security outcomes such as coverage false-positive rate exploit validation rate time-to-triage and time-to-remediation.
• Develop automation integrations scripts and lightweight internal tooling to improve testing coverage reduce manual effort and extend security capabilities where needed.
• Create documentation templates and self-service enablement that help engineering teams adopt secure patterns and scale security practices.
• Support application/API-related security investigations by providing technical analysis exploit context and remediation guidance.

Qualifications / Requirements / Skills:

• 5 years (or equivalent) of experience in application security product security offensive security or secure software engineering with strong hands-on technical depth.
• Strong hands-on experience in web application and API security including vulnerability identification exploit validation remediation support and secure design considerations.
• Demonstrated ability to evaluate implement and operationalize AI-assisted security tooling/workflows (build vs. buy) with a focus on measurable improvements in signal quality coverage and remediation efficiency.
• Demonstrated experience scaling DAST and automated dynamic testing including authenticated scanning scan tuning and CI/CD integration.
• Strong expertise in API security including OAuth2/OIDC JWT API gateways authorization testing and testing techniques for REST and GraphQL APIs.
• Practical experience implementing and tuning RASP or similar in-process runtime protections in production environments.
• Deep understanding of the OWASP Top 10 and OWASP API Security Top 10 especially authorization failures (BOLA/BFLA) injection SSRF deserialization security misconfiguration and business logic abuse.
• Ability to write code and build technical solutions to automate workflows develop integrations create test harnesses/utilities or build lightweight internal security tools when needed.
• Proficiency in one or more scripting/programming languages such as Python Go JavaScript or Bash with demonstrated ability to apply coding skills to security engineering problems.
• Strong understanding of modern application architectures including APIs microservices cloud-native design patterns authentication flows and runtime environments.
• Working knowledge of cloud-native platforms and production concepts (containers Kubernetes observability/logging/tracing) with the ability to use that knowledge in support of application security engineering.
• Strong communication skills and the ability to translate security findings into clear prioritized engineering actions for developers and stakeholders.

Nice-to-Haves / Preferred or Desired Skills:

• Experience developing internal security tools custom integrations reusable libraries or testing frameworks to extend AppSec capabilities.
• Background in offensive security adversarial testing bug bounty web exploitation or vulnerability research.
• Experience applying analytics/ML concepts to security telemetry (behavior baselining anomaly detection clustering/deduplication) for APIs and runtime signals.
• Familiarity with AI-assisted secure SDLC use cases such as code/query generation for test cases guided threat modeling and intelligent fuzzing with strong validation practices.
• Experience defining quality metrics for AI outputs (precision/recall proxies FP/FN tracking drift detection) and operating feedback loops.
• Experience with API discovery platforms and managing shadow/zombie API reduction programs (inventory ownership governance workflows).
• Hands-on experience with GraphQL-specific risks including introspection exposure depth/complexity attacks and field-level authorization weaknesses.
• Experience designing safe enforcement strategies for production protections including progressive rollout canarying SLO awareness and performance testing.
• Familiarity with service mesh patterns (mTLS traffic policies) and edge protections (WAF/WAAP concepts) as they relate to API protection.
• Relevant certifications such as OSWE GIAC GWAPT/GWEB or similar hands-on application security credentials.

Supervisor:

No

Our Lead Cybersecurity earns between$128400-$192600 USD Annual Not to mention all the other amazing rewards that working at AT&T offers. Individual starting salary within this range may depend on geography experience expertise and education/training.

Joining our team comes with amazing perks and benefits:

• Medical/Dental/Vision coverage
• 401(k) plan
• Tuition reimbursement program
• Paid Time Off and Holidays (based on date of hire at least 23 days of vacation each year and 9 company-designated holidays)
• Paid Parental Leave
• Paid Caregiver Leave
• Additional sick leave beyond what state and local law require may be available but is unprotected
• Adoption Reimbursement
• Disability Benefits (short term and long term)
• Life and Accidental Death Insurance
• Supplemental benefit programs: critical illness/accident hospital indemnity/group legal
• Employee Assistance Programs (EAP)
• Extensive employee wellness programs
• Employee discounts up to 50% off on eligible AT&T mobility plans and accessories
• AT&T internet (and fiber where available) and AT&T phone.

#LI-Onsite Full-time office role-

Joining our team comes with amazing perks and benefits:

• Medical/Dental/Vision coverage
• 401(k) plan
• Tuition reimbursement program
• Paid Time Off and Holidays (based on date of hire at least 23 days of vacation each year and 9 company-designated holidays)
• Paid Parental Leave
• Paid Caregiver Leave
• Additional sick leave beyond what state and local law require may be available but is unprotected
• Adoption Reimbursement
• Disability Benefits (short term and long term)
• Life and Accidental Death Insurance
• Supplemental benefit programs: critical illness/accident hospital indemnity/group legal
• Employee Assistance Programs (EAP)
• Extensive employee wellness programs
• Employee discounts up to 50% off on eligible AT&T mobility plans and accessories AT&T internet (and fiber where available) and AT&T phone

Weekly Hours:

Time Type:

Location:

Salary Range:

It is the policy of AT&T to provide equal employment opportunity (EEO) to all persons regardless of age color national origin citizenship status physical or mental disability race religion creed gender sex sexual orientation gender identity and/or expression genetic information marital status status with regard to public assistance veteran status or any other characteristic protected by federal state or local addition AT&T will provide reasonable accommodations for qualified individuals with disabilities.AT&T is a fair chance employer and does not initiate a background check until an offer is made.