OPT Application Security Engineer Jobs
Application Security Engineer jobs are consistently sponsored on OPT, with employers ranging from fintech and cloud infrastructure firms to enterprise software companies. Most roles require a computer science or cybersecurity degree, making them a strong fit for STEM OPT's 24-month extension. Cap-exempt employers and government contractors frequently hire in this field.
Find OPT Application Security Engineer JobsOverview
Showing 5 of 196+ Application Security Engineer jobs
See all 196+ Application Security Engineer Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Application Security Engineer roles.
Get Access To All JobsINTRODUCTION
At Blue Cross and Blue Shield of Nebraska, we are a mission-driven organization dedicated to championing the health and well-being of our members and the communities we serve.
Our team is the power behind that promise. And, as the industry rapidly evolves and we seek ways to optimize business processes and customer experiences, there’s no greater time for forward-thinking professionals like you to join us in delivering on it! As a member of Team Blue, you’ll find purpose, opportunities and the support you need to build a meaningful career and make a powerful impact in our community.
ROLE AND RESPONSIBILITIES
The Senior Application Security Engineer will serve as a technical leader and owner of company application security capabilities. This role is responsible for implementing and operating secure software development practices across the enterprise, with a strong focus on static and dynamic code analysis, DevSecOps integration, AI-related code risk, and risk-based vulnerability management.
We are looking for an experienced practitioner who can operate independently, take ownership of outcomes, and partner effectively with engineering, architecture, and risk teams to deliver practical, scalable security solutions. The ideal candidate will live within driving distance of the Omaha, Nebraska office. This position allows remote flexibility but will have 1 day per week in the office.
If living in one of our approved states (Florida, Iowa, Kansas, Minnesota, Missouri, Nebraska, North Dakota, and Texas) – this person may travel to our headquarters based on business needs.
What you'll do:
- Own and operate application security tooling, including SAST, DAST, and software composition analysis, ensuring tools are tuned, effective, and aligned to business risk.
- Embed application security into CI/CD pipelines and development workflows to support shift-left security while minimizing developer friction.
- Perform secure code reviews and validate vulnerabilities for exploitability, impact, and remediation feasibility.
- Define and maintain secure coding standards, guidance, and reusable security patterns for development teams.
- Establish guardrails and review expectations for AI-assisted and AI-generated code, reducing unowned and unmanaged application risk.
- Partner with development teams to triage findings, reduce false positives, and drive effective remediation.
- Apply risk-based decision making aligned to organizational risk appetite and compliance frameworks (NIST, HIPAA, SOC 2).
- Support application threat modeling and identification of architectural security gaps.
- Collaborate with cloud, platform, and identity teams to ensure applications integrate securely with enterprise services.
- Contribute to audit readiness, evidence collection, and regulatory support related to application security controls.
- Reduce single-points-of-failure by documenting processes, mentoring others, and improving program resiliency.
BASIC QUALIFICATIONS
To be considered for this position you must have:
- Bachelor’s degree in Computer Science, Information Security, or a related field (or equivalent experience).
- 6 years of experience in application security, secure software development, or DevSecOps.
- Hands-on experience with SAST, DAST, and dependency scanning tools, including tuning and operational ownership.
- Strong understanding of application vulnerability classes (OWASP Top 10, APIs, authentication, authorization).
- Experience integrating security into CI/CD pipelines and development workflows.
- Proven ability to assess risk, prioritize remediation, and clearly communicate decisions.
- Comfort working independently, taking ownership, and driving outcomes with minimal oversight.
- Strong communication skills with the ability to work effectively with developers, architects, and leadership.
PREFERRED QUALIFICATIONS
The strongest candidates will also have:
- Experience in healthcare or other regulated industries.
- Familiarity with Azure PaaS and cloud-native application architectures.
- Exposure to AI-assisted development risks, automation, or modern code-generation tools.
- Threat modeling experience and security design review participation.
- Scripting or automation experience (Python, PowerShell, Bash).
- Relevant certifications (CSSLP, GWAPT, CISSP, or equivalent).
An equivalent combination of education and experience may be substituted for this requirement. The ability to meet or exceed the attendance and timeliness requirements of their departments. On-call work may be required based on business needs and role assignment. The ability to work well in a team environment and be capable of building and maintaining positive relationships with other staff, departments, and customers.
To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed are representative of the knowledge, skill, and or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. Other duties may be assigned.
What We Offer You
Learn more about what makes BCBSNE such an exceptional place to work, including details about our comprehensive Total Rewards package, by visiting NebraskaBlue.com/Careers.
We strongly believe that diversity of experience, perspective and background will lead to a better workplace for our employees and a better product for our customers and members.
Stay Safe from Job Scams
BCBSNE only accepts job applications submitted through our official careers website. Genuine correspondence will always come from an email address ending with @nebraskablue.com. We do not ask for sensitive personal information, such as banking details, and we ensure interviews take place before any job offer is made.
EEO Statement
BCBSNE is an Equal Opportunity /Affirmative Action Employer, M/F/D/V. If you are a qualified individual with a disability or a disabled veteran, you have the right to request an accommodation if you are unable or limited in your ability to use or access our career center as a result of your disability. To request an accommodation, contact a Human Resources Representative at BCBSNE.
INTRODUCTION
At Blue Cross and Blue Shield of Nebraska, we are a mission-driven organization dedicated to championing the health and well-being of our members and the communities we serve.
Our team is the power behind that promise. And, as the industry rapidly evolves and we seek ways to optimize business processes and customer experiences, there’s no greater time for forward-thinking professionals like you to join us in delivering on it! As a member of Team Blue, you’ll find purpose, opportunities and the support you need to build a meaningful career and make a powerful impact in our community.
ROLE AND RESPONSIBILITIES
The Senior Application Security Engineer will serve as a technical leader and owner of company application security capabilities. This role is responsible for implementing and operating secure software development practices across the enterprise, with a strong focus on static and dynamic code analysis, DevSecOps integration, AI-related code risk, and risk-based vulnerability management.
We are looking for an experienced practitioner who can operate independently, take ownership of outcomes, and partner effectively with engineering, architecture, and risk teams to deliver practical, scalable security solutions. The ideal candidate will live within driving distance of the Omaha, Nebraska office. This position allows remote flexibility but will have 1 day per week in the office.
If living in one of our approved states (Florida, Iowa, Kansas, Minnesota, Missouri, Nebraska, North Dakota, and Texas) – this person may travel to our headquarters based on business needs.
What you'll do:
- Own and operate application security tooling, including SAST, DAST, and software composition analysis, ensuring tools are tuned, effective, and aligned to business risk.
- Embed application security into CI/CD pipelines and development workflows to support shift-left security while minimizing developer friction.
- Perform secure code reviews and validate vulnerabilities for exploitability, impact, and remediation feasibility.
- Define and maintain secure coding standards, guidance, and reusable security patterns for development teams.
- Establish guardrails and review expectations for AI-assisted and AI-generated code, reducing unowned and unmanaged application risk.
- Partner with development teams to triage findings, reduce false positives, and drive effective remediation.
- Apply risk-based decision making aligned to organizational risk appetite and compliance frameworks (NIST, HIPAA, SOC 2).
- Support application threat modeling and identification of architectural security gaps.
- Collaborate with cloud, platform, and identity teams to ensure applications integrate securely with enterprise services.
- Contribute to audit readiness, evidence collection, and regulatory support related to application security controls.
- Reduce single-points-of-failure by documenting processes, mentoring others, and improving program resiliency.
BASIC QUALIFICATIONS
To be considered for this position you must have:
- Bachelor’s degree in Computer Science, Information Security, or a related field (or equivalent experience).
- 6 years of experience in application security, secure software development, or DevSecOps.
- Hands-on experience with SAST, DAST, and dependency scanning tools, including tuning and operational ownership.
- Strong understanding of application vulnerability classes (OWASP Top 10, APIs, authentication, authorization).
- Experience integrating security into CI/CD pipelines and development workflows.
- Proven ability to assess risk, prioritize remediation, and clearly communicate decisions.
- Comfort working independently, taking ownership, and driving outcomes with minimal oversight.
- Strong communication skills with the ability to work effectively with developers, architects, and leadership.
PREFERRED QUALIFICATIONS
The strongest candidates will also have:
- Experience in healthcare or other regulated industries.
- Familiarity with Azure PaaS and cloud-native application architectures.
- Exposure to AI-assisted development risks, automation, or modern code-generation tools.
- Threat modeling experience and security design review participation.
- Scripting or automation experience (Python, PowerShell, Bash).
- Relevant certifications (CSSLP, GWAPT, CISSP, or equivalent).
An equivalent combination of education and experience may be substituted for this requirement. The ability to meet or exceed the attendance and timeliness requirements of their departments. On-call work may be required based on business needs and role assignment. The ability to work well in a team environment and be capable of building and maintaining positive relationships with other staff, departments, and customers.
To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed are representative of the knowledge, skill, and or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. Other duties may be assigned.
What We Offer You
Learn more about what makes BCBSNE such an exceptional place to work, including details about our comprehensive Total Rewards package, by visiting NebraskaBlue.com/Careers.
We strongly believe that diversity of experience, perspective and background will lead to a better workplace for our employees and a better product for our customers and members.
Stay Safe from Job Scams
BCBSNE only accepts job applications submitted through our official careers website. Genuine correspondence will always come from an email address ending with @nebraskablue.com. We do not ask for sensitive personal information, such as banking details, and we ensure interviews take place before any job offer is made.
EEO Statement
BCBSNE is an Equal Opportunity /Affirmative Action Employer, M/F/D/V. If you are a qualified individual with a disability or a disabled veteran, you have the right to request an accommodation if you are unable or limited in your ability to use or access our career center as a result of your disability. To request an accommodation, contact a Human Resources Representative at BCBSNE.
See all 196+ OPT Application Security Engineer Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new OPT Application Security Engineer Jobs.
Get Access To All JobsTips for Finding OPT Sponsorship as an Application Security Engineer
Lead with your security certifications
OSCP, CEH, and Security+ certifications signal hands-on competence to hiring managers faster than a degree alone. OPT students who hold at least one recognized security credential move through technical screenings at a noticeably higher rate in this field.
Target STEM-designated program employers first
Application Security Engineering falls under CIP codes that qualify for the 24-month STEM OPT extension. Prioritize employers already familiar with STEM OPT obligations, since they understand the timeline and are far less likely to withdraw offers over authorization concerns.
Demonstrate experience with specific security frameworks
OWASP Top 10, NIST, and MITRE ATT&CK are referenced in most job descriptions. Calling out specific frameworks you have applied, not just studied, in your resume and cover letter directly addresses what hiring managers are screening for in this role.
Highlight any bug bounty or capture-the-flag experience
Practical proof of skill matters more in security than in most engineering disciplines. Bug bounty reports on HackerOne or CTF placements are legitimate portfolio items that demonstrate offensive and defensive competencies employers cannot easily assess from academic credentials.
Understand your employer's H-1B sponsorship history before applying
Application Security Engineers are in high demand, but sponsorship willingness varies significantly by company size and legal infrastructure. Researching a company's past H-1B visa filings through public OFLC disclosure data helps you prioritize employers likely to support long-term sponsorship after OPT.
Be specific about your OPT start date and STEM extension eligibility
Recruiters in security-sensitive industries need clear authorization timelines upfront. Stating your OPT end date and confirming STEM extension eligibility in your initial outreach eliminates ambiguity and positions you as a candidate who understands their own authorization, which builds recruiter confidence.
Application Security Engineer OPT: Frequently Asked Questions
Is Application Security Engineer a STEM OPT-eligible role?
Yes. Application Security Engineering roles typically fall under CIP codes in computer science and information security, both of which qualify for the 24-month STEM OPT extension. This gives eligible F-1 students up to three years of work authorization in total, making this one of the stronger fields for OPT students pursuing long-term U.S. employment.
Do employers in this field commonly sponsor OPT students?
Yes, particularly at mid-size and large technology companies, financial institutions, and cloud infrastructure firms. Application security is a specialist function with a well-documented talent shortage, which pushes many employers to sponsor candidates they would otherwise pass on. You can browse OPT-friendly Application Security Engineer openings directly on Migrate Mate, where listings are filtered for sponsorship willingness.
Can I work as an Application Security Engineer on OPT if my degree is in computer science rather than cybersecurity?
Yes. USCIS does not require your degree to be in cybersecurity specifically. A computer science, software engineering, or information systems degree is sufficient, provided your coursework or experience connects reasonably to the security function of the role. Most employers in this field regularly hire engineers with general CS backgrounds who have developed security specialization through coursework, certifications, or projects.
What should I do if a job posting says 'U.S. citizens or permanent residents only'?
This restriction almost always reflects government contracting requirements or access to classified systems, not a general sponsorship policy. For commercial application security roles without clearance requirements, most large employers do not impose this restriction. Focus your search on roles at companies without federal contract dependencies, and use Migrate Mate to filter for positions explicitly open to OPT applicants.
How early should I start my Application Security Engineer job search before my OPT start date?
Start at least three to four months before your expected OPT start date. Technical hiring processes in security often include multiple interview rounds, take-home assessments, and background checks that can run four to six weeks from first contact to offer. Beginning early leaves room to negotiate start dates that align with your EAD arrival and reduces the risk of accepting a role under time pressure.