Remote Application Security Specialist Jobs
Remote application security specialist jobs are in active demand across the U.S., with remote-first firms and distributed engineering teams hiring specialists to secure software pipelines, review code for vulnerabilities, and lead AppSec programs without a physical office. Industries including fintech, cloud infrastructure, healthcare technology, and enterprise SaaS consistently post remote openings, and employers hiring right now include CVS Health, AbbVie, and Zeta Global. Scan the live roles below and apply to whichever ones fit.
Find JobsOverview
Showing 5 of 63+ Remote Application Security Specialist jobs
Job Description
Position: Application Security Engineer (AI Governance & Cloud Security)
Reports To: Director, IT, Info Security and Compliance
Job Overview
Reveal is hiring an Application Security Engineer to secure how we build software and how we adopt AI. This role sits at the point where three things meet: the security of the code and services we ship, the governance of the AI agents and models we put into production, and the posture of the cloud they all run on.
You will own the tooling that makes that possible — Onyx Security as the control plane for AI agents and models, and Wiz across our cloud accounts and repositories — and you will be the person engineering teams come to when a design, a pipeline or a new AI tool needs a security opinion. The work is hands-on: threat modeling, code review, remediation alongside the teams that own the fix, and the policy and reporting that lets leadership and auditors see where we stand.
This role follows a hybrid model (4 days in office, 1 day work from home) for candidates residing in Illinois. Candidates based outside of Illinois may be considered for a remote work arrangement.
Responsibilities & Duties
- Application security: Run threat modeling and secure design reviews for new features, services and integrations.
- Application security: Perform manual code review and triage findings from SAST, DAST, SCA and secrets scanning.
- Application security: Embed security checks into CI/CD pipelines without slowing delivery.
- Application security: Lead remediation with engineering teams and track findings to closure against SLAs.
- Application security: Support penetration tests, bug reports and customer security questionnaires.
- AI governance: Own the Onyx Security platform as the control plane for AI agents and models across SaaS, cloud, endpoints and code.
- AI governance: Use Onyx AI Observability to discover sanctioned and shadow AI, and review prompts, responses and agent actions.
- AI governance: Write and enforce natural-language governance policies and real-time guardrails in Onyx.
- AI governance: Manage agent permissions and secure MCP server connections to prevent over-privileged access.
- AI governance: Detect and respond to prompt injection, data exfiltration and AI misuse, and tune Onyx Guardian Agent remediation.
- AI governance: Maintain the AI acceptable-use policy, AI inventory and risk assessments with GRC, mapped to NIST AI RMF and ISO/IEC 42001.
- AI governance: Evaluate new AI tools, agents and vendors before adoption, and report AI adoption and risk metrics to leadership.
- Cloud and code security: Own Wiz configuration, integrations, policies and alert routing across cloud accounts.
- Cloud and code security: Triage Wiz Issues and toxic combinations, and drive fixes for misconfigurations, vulnerabilities and exposed secrets.
- Cloud and code security: Use Wiz Code and IaC scanning to catch risk in repositories and Terraform before deployment.
- Cloud and code security: Use Wiz AI Security Posture Management (AI-SPM) to inventory AI services and models running in the cloud.
- Cloud and code security: Build reports and dashboards on cloud risk trends for Security leadership and audits.
- Perform other duties and responsibilities as assigned to support team, department, and organizational goals.
Characteristics
- Breadth across domains: comfortable moving between application security, AI governance and cloud posture rather than specialising in only one.
- Investigative mindset: naturally curious, and inclined to dig into an alert or a finding until the underlying cause is understood.
- Proactive problem solver: anticipates security issues at design time rather than discovering them at deployment.
- Autonomous and collaborative: takes ownership of the role and works effectively with distributed engineering teams.
- Clear communicator: can explain the same risk to an engineer, to leadership and to an auditor, and be understood by all three.
Education & Experience
- 4+ years in application security, product security or security engineering.
- Solid grasp of OWASP Top 10, OWASP Top 10 for LLM Applications and agentic AI risks, including Model Context Protocol (MCP) security.
- Ability to read and review code in at least one of Python, JavaScript/TypeScript, Java or C#.
- Experience securing AWS, Azure or GCP workloads, containers and Kubernetes.
- Familiarity with CI/CD tooling (GitHub Actions, GitLab CI or Azure DevOps) and infrastructure as code.
- Clear written communication for engineers, leadership and auditors.
Preferred Experience
- Experience building an AI governance program: AI inventory, model risk reviews, acceptable-use policy.
- Hands-on experience with Wiz, including policy tuning, Issue triage and integrations (Jira, Slack, SIEM).
- Hands-on experience with Onyx Security or a comparable AI security and governance platform, including AI discovery, guardrails and agent permissions.
- Knowledge of NIST AI RMF, ISO/IEC 42001 and the EU AI Act.
- Experience supporting SOC 2, ISO 27001 or FedRAMP audits.
- Background in legal tech, eDiscovery or other environments handling sensitive client data.
- Scripting for automation (Python, Bash, Ruby) and experience with the Wiz API.
- Certifications such as OSWE, GWAPT, CSSLP, CCSP or AWS Security Specialty, or the Wiz certifications.
Benefits and Perks include but are not limited to:
- 401k match program
- Comprehensive health benefits (Medical, Dental, Vision, and HSA/FSA)
- Group Term Life Insurance and Voluntary Life Insurance option
- Paid holidays
- Paid vacation, sick, and personal days
- FSA dependent care benefit
- Childbirth recovery and bonding leave policies
- Short and long-term disability benefits
- Access to onsite gym and recreational area at our Chicago office
- Friendly, collaborative, in-office work environment with ample opportunity for professional development.
For Illinois-based roles, the budgeted annual salary range is $ 136,000 to $ 160,000. Compensation for this role will depend on a number of factors, including a candidate's qualifications, skills, competencies, and experience, and may fall outside of the range shown. Reveal offers a competitive total rewards package, which includes the Benefits and Perks set forth above.
This job description reflects the present requirements of the position. As duties and responsibilities change and develop, the job description will be reviewed and subject to amendment.
Hiring Policy
Reveal is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. Reveal does not discriminate in employment on the basis of race, color, religion, sex (including pregnancy and gender identity), national origin, political affiliation, sexual orientation, marital status, disability, genetic information, age, membership in an employee organization, retaliation, parental status, military service, or other non-merit factor.
Reveal considers candidates with existing visas but does not sponsor new visa applications.
Job Description
Position: Application Security Engineer (AI Governance & Cloud Security)
Reports To: Director, IT, Info Security and Compliance
Job Overview
Reveal is hiring an Application Security Engineer to secure how we build software and how we adopt AI. This role sits at the point where three things meet: the security of the code and services we ship, the governance of the AI agents and models we put into production, and the posture of the cloud they all run on.
You will own the tooling that makes that possible — Onyx Security as the control plane for AI agents and models, and Wiz across our cloud accounts and repositories — and you will be the person engineering teams come to when a design, a pipeline or a new AI tool needs a security opinion. The work is hands-on: threat modeling, code review, remediation alongside the teams that own the fix, and the policy and reporting that lets leadership and auditors see where we stand.
This role follows a hybrid model (4 days in office, 1 day work from home) for candidates residing in Illinois. Candidates based outside of Illinois may be considered for a remote work arrangement.
Responsibilities & Duties
- Application security: Run threat modeling and secure design reviews for new features, services and integrations.
- Application security: Perform manual code review and triage findings from SAST, DAST, SCA and secrets scanning.
- Application security: Embed security checks into CI/CD pipelines without slowing delivery.
- Application security: Lead remediation with engineering teams and track findings to closure against SLAs.
- Application security: Support penetration tests, bug reports and customer security questionnaires.
- AI governance: Own the Onyx Security platform as the control plane for AI agents and models across SaaS, cloud, endpoints and code.
- AI governance: Use Onyx AI Observability to discover sanctioned and shadow AI, and review prompts, responses and agent actions.
- AI governance: Write and enforce natural-language governance policies and real-time guardrails in Onyx.
- AI governance: Manage agent permissions and secure MCP server connections to prevent over-privileged access.
- AI governance: Detect and respond to prompt injection, data exfiltration and AI misuse, and tune Onyx Guardian Agent remediation.
- AI governance: Maintain the AI acceptable-use policy, AI inventory and risk assessments with GRC, mapped to NIST AI RMF and ISO/IEC 42001.
- AI governance: Evaluate new AI tools, agents and vendors before adoption, and report AI adoption and risk metrics to leadership.
- Cloud and code security: Own Wiz configuration, integrations, policies and alert routing across cloud accounts.
- Cloud and code security: Triage Wiz Issues and toxic combinations, and drive fixes for misconfigurations, vulnerabilities and exposed secrets.
- Cloud and code security: Use Wiz Code and IaC scanning to catch risk in repositories and Terraform before deployment.
- Cloud and code security: Use Wiz AI Security Posture Management (AI-SPM) to inventory AI services and models running in the cloud.
- Cloud and code security: Build reports and dashboards on cloud risk trends for Security leadership and audits.
- Perform other duties and responsibilities as assigned to support team, department, and organizational goals.
Characteristics
- Breadth across domains: comfortable moving between application security, AI governance and cloud posture rather than specialising in only one.
- Investigative mindset: naturally curious, and inclined to dig into an alert or a finding until the underlying cause is understood.
- Proactive problem solver: anticipates security issues at design time rather than discovering them at deployment.
- Autonomous and collaborative: takes ownership of the role and works effectively with distributed engineering teams.
- Clear communicator: can explain the same risk to an engineer, to leadership and to an auditor, and be understood by all three.
Education & Experience
- 4+ years in application security, product security or security engineering.
- Solid grasp of OWASP Top 10, OWASP Top 10 for LLM Applications and agentic AI risks, including Model Context Protocol (MCP) security.
- Ability to read and review code in at least one of Python, JavaScript/TypeScript, Java or C#.
- Experience securing AWS, Azure or GCP workloads, containers and Kubernetes.
- Familiarity with CI/CD tooling (GitHub Actions, GitLab CI or Azure DevOps) and infrastructure as code.
- Clear written communication for engineers, leadership and auditors.
Preferred Experience
- Experience building an AI governance program: AI inventory, model risk reviews, acceptable-use policy.
- Hands-on experience with Wiz, including policy tuning, Issue triage and integrations (Jira, Slack, SIEM).
- Hands-on experience with Onyx Security or a comparable AI security and governance platform, including AI discovery, guardrails and agent permissions.
- Knowledge of NIST AI RMF, ISO/IEC 42001 and the EU AI Act.
- Experience supporting SOC 2, ISO 27001 or FedRAMP audits.
- Background in legal tech, eDiscovery or other environments handling sensitive client data.
- Scripting for automation (Python, Bash, Ruby) and experience with the Wiz API.
- Certifications such as OSWE, GWAPT, CSSLP, CCSP or AWS Security Specialty, or the Wiz certifications.
Benefits and Perks include but are not limited to:
- 401k match program
- Comprehensive health benefits (Medical, Dental, Vision, and HSA/FSA)
- Group Term Life Insurance and Voluntary Life Insurance option
- Paid holidays
- Paid vacation, sick, and personal days
- FSA dependent care benefit
- Childbirth recovery and bonding leave policies
- Short and long-term disability benefits
- Access to onsite gym and recreational area at our Chicago office
- Friendly, collaborative, in-office work environment with ample opportunity for professional development.
For Illinois-based roles, the budgeted annual salary range is $ 136,000 to $ 160,000. Compensation for this role will depend on a number of factors, including a candidate's qualifications, skills, competencies, and experience, and may fall outside of the range shown. Reveal offers a competitive total rewards package, which includes the Benefits and Perks set forth above.
This job description reflects the present requirements of the position. As duties and responsibilities change and develop, the job description will be reviewed and subject to amendment.
Hiring Policy
Reveal is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. Reveal does not discriminate in employment on the basis of race, color, religion, sex (including pregnancy and gender identity), national origin, political affiliation, sexual orientation, marital status, disability, genetic information, age, membership in an employee organization, retaliation, parental status, military service, or other non-merit factor.
Reveal considers candidates with existing visas but does not sponsor new visa applications.
See All 63 Remote Application Security Specialist Jobs
Find roles that match your experience and apply in just a few clicks.
Find JobsRemote Application Security Specialist Job Market
Who's Hiring
Top Industries Hiring
- Biotechnology & Pharmaceuticals
- Insurance
- Technology & Software
- Banking & Financial Services
- Agriculture & Farming
What Employers Look For
The qualifications that appear most often in remote application security specialist jobs.
- Proficiency in SAST and DAST tools such as Burp Suite, Checkmarx, or Veracode
- Experience with penetration testing and vulnerability assessment across web and API surfaces
- Knowledge of secure software development lifecycle practices and threat modeling
- Relevant certifications such as OSCP, CISSP, CEH, or GWEB
- Ability to read and audit code in one or more languages including Python, Java, or JavaScript
- Bachelor's degree in computer science, information security, or a related technical field
Tips for Your Remote Application Security Specialist Job Search
Apply early to remote roles that fit
Migrate Mate lists remote application security specialist openings from across the U.S. in one place, so you can find roles that match your skills and apply directly without sorting through location-filtered listings on general job boards.
Show async security communication in your application
Remote AppSec teams rely on written channels for vulnerability reports, risk assessments, and developer guidance. Include writing samples or links to documentation you've authored, like security runbooks or disclosed bug reports, to prove you communicate security findings clearly without synchronous meetings.
Highlight distributed toolchain experience upfront
Remote application security specialists are expected to operate within cloud-native and DevSecOps workflows from day one. Call out specific tools you've used in distributed environments, such as Semgrep, Snyk, Burp Suite, or pipeline-integrated SAST scanners, so hiring managers see relevant hands-on experience immediately.
Prepare for async-first remote interviews
Many remote-first companies use asynchronous take-home assessments, recorded video screens, or written technical exercises before a live call. Practice articulating your approach to a threat model or code review in writing, since your written reasoning often matters as much as your verbal answers in remote hiring.
Remote Application Security Specialist Jobs: Frequently Asked Questions
How do I get a remote application security specialist job?
Target companies with distributed engineering teams, since remote-first firms and cloud-native organizations are most likely to hire application security specialists without requiring on-site presence. Remote employers screen for strong async written communication, the ability to self-direct security reviews without daily oversight, and hands-on skills in SAST, DAST, threat modeling, and secure code review. Certifications like OSCP, CEH, or CSSLP strengthen your profile, and a GitHub portfolio demonstrating real vulnerability findings or tooling gives you a concrete edge.
Which companies hire remote application security specialists?
Companies hiring remote application security specialists right now include CVS Health, AbbVie, and Zeta Global, based on current remote listings on Migrate Mate as of November 2026. Remote openings for this role are most common at remote-first technology firms, distributed fintech companies, and enterprise SaaS organizations that run engineering teams across multiple time zones.
Can you get a remote application security specialist job with no experience?
Yes, but remote entry-level roles are harder to land because you're expected to operate independently from day one without a senior engineer sitting nearby. Remote-first startups and mid-size SaaS companies are more open to junior candidates than large enterprises. Demonstrating hands-on work through CTF competitions, bug bounty programs, or personal security research projects shows initiative in the absence of professional experience, and earning a recognized entry-level certification helps validate your skills.
Do you need a degree for remote application security specialist jobs?
Not always. Remote employers in this role place significant weight on demonstrable technical skills, practical security knowledge, and results you can point to, whether that's disclosed vulnerabilities, security tooling you've built, or certifications you've earned. A degree in computer science or a related field is listed as preferred in many postings, but candidates who show strong AppSec fundamentals and real-world output routinely compete effectively without one.
Which industries hire the most remote application security specialists?
Most remote application security specialist openings sit in Biotechnology & Pharmaceuticals, Insurance, and Technology & Software, per current remote listings on Migrate Mate as of November 2026. These sectors rely heavily on distributed engineering teams that build and maintain software products requiring continuous security review, making remote application security work a natural fit.
See All 63 Remote Application Security Specialist Jobs
Find roles that match your experience and apply in just a few clicks.
Find Jobs