STEM OPT Application Security Engineer Jobs
Application Security Engineer roles qualify for STEM OPT because they fall under computer science and engineering CIP codes. Your 24-month STEM OPT extension gives you up to 36 months of total work authorization, provided your employer is enrolled in E-Verify and you file a completed I-983 training plan with your DSO.
Find STEM OPT Application Security Engineer JobsOverview
Showing 5 of 22+ Application Security Engineer jobs
Have you applied for this role?
Have you applied for this role?
Have you applied for this role?
Have you applied for this role?
Have you applied for this role?
See all Application Security Engineer Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Application Security Engineer roles.
Get Access To All JobsSoar with us at Wawa. We believe we can make life a little better every day – one smile, hoagie, or experience at a time. And there’s one secret ingredient that truly sets Wawa apart: Our Associates. At Wawa, you’ll be part of a caring team that’s dedicated to helping all of us fly high – together. We’re team players, day-brighteners, and go-getters: and we know that Wawa is a place where we can build skills to thrive and open doors to new career opportunities. We’re proud to be a part of a winning team of Associate owners who shape our success. We’re committed to helping our communities and one another at every turn, because we know that when we fly together, there’s no limit to how far we can go. Ready to be part of a team that helps you reach new heights? Join our flock and get ready to soar.
Job Description
Job Title: Application Security Engineer
Location: Corporate
Department: Information Technology
Job Summary: The Application Security Engineer is responsible for operating, supporting, maintaining, and improving the application security program by helping to ensure that security is built into all internally developed applications. This role executes all day-to-day operations, maintenance, functions, and capabilities relating to application security. Assist with the build and operation of application security tooling, automation, and engage with developers and product owners to solve application security problems. The role serves as a technical resource in the areas of secure software development at all stages of the SDLC and general information security best practices across all technology domains. The engineer is responsible for operating and improving Wawa’s application security processes to secure and maintain Wawa’s technology.
Principal Duties:
Operate and Support the Application Security Program
- Support security best practices in the software development lifecycle by way of working closely with developers and product owners to secure applications at all stages.
- Research, identify and communicate current and emerging application security threats and solutions.
- Maintain, and iterate on secure coding practices, policies, standards, and procedures.
- Test applications against security threats and vulnerabilities.
- Support application security vulnerability management.
- Create and deliver security presentations to technical and non-technical internal audiences.
- Identify security design gaps in existing and proposed applications and recommend changes or enhancements.
- Identify gaps and inefficiencies in the Application Security Program on a continual basis and propose solutions.
- Participate in and support application security reviews, penetration tests, and threat modeling.
- Contribute to the direction of internal security-focused programs.
Provide Strategic Support
- Assist in the development of metrics and reporting framework to measure the effectiveness of the program.
- Support the development and maintenance of Wawa’s technology security policies and standards and ensure their application to technology architectures.
- Assist with ensuring the ongoing compliance with both regulatory obligations and internally developed policies and standards.
- Provide support to Technology Security Incident Response team during cyber incidents.
Serve as Security Liaison
- Maintain internal networks among information security, information technology, and development teams to ensure support and alignment on initiatives.
- Maintain external networks consisting of industry peers, ecosystem partners, vendors, and other relevant parties to address common trends, findings, and cybersecurity risks.
- Act as technical resource for internal business teams and the IT department to plan, implement, and support new and existing software.
- Support audit and assessment process for IT including annual PCI audit, IT general controls review, and any other audits or assessments of security and general IT controls.
- Provide application security guidance on IT and business-related projects as required by the business. Participate in IT and security related projects.
- Work effectively with business units to facilitate applications security engineering requirements and advocate application security best practices.
Essential Skills:
- Ability to maintain and exude a positive attitude by committing to new ideas, being enthusiastic about work, and being helpful to, and thoughtful and considerate of, others across the organization.
- Proven experience securing custom software.
- Ability to work well individually and in a team environment.
- Ability to learn on the job.
- Ability to track task progress effectively.
- Experience working with teams of developers and product owners.
- Excellent written and verbal communication skills, interpersonal and collaborative skills, and the ability to communicate application security and risk-related concepts to diverse audiences.
- Poise and ability to act calmly and competently in high-pressure, high-stress situations.
- Must be a critical thinker, with strong problem-solving skills.
- Ability to manage multiple projects under strict timelines, as well as the ability to work well in a demanding, dynamic environment and meet overall objectives.
- Ability to engage in internal security technology projects and security remediation projects.
- Ability to understand large technology implementations spanning hundreds of physical and virtual environments.
- High level of personal integrity, as well as the ability to professionally handle confidential matters and show an appropriate level of judgment and maturity.
- High degree of initiative, dependability, and ability to work with little supervision while being resilient to change.
- Ability to be on-call 24x7x365 rotation for information security incidents.
Basic Requirements:
- Minimum of 2 years of experience in a complex technology environment, working in the application security engineering field.
- Advanced knowledge of containers and container security.
- Solid knowledge of cloud technology and security.
- Solid knowledge of Java programming.
- Basic knowledge of Golang programming.
- Basic knowledge of React and React Native programming.
- Experience with reading and writing enterprise software.
- Experience preventing and remediating software security flaws in enterprise software.
- Up-to-date knowledge of common security weaknesses and flaws, and how to prevent and remediate them.
- Advanced knowledge of OWASP guidance.
- Solid knowledge of web-related protocols (TCP/IP, HTTP, HTTPS, REST, etc.).
- Understanding of relevant legal and regulatory requirements, such as Payment Card Industry Data Security Standard.
- Degree in computer science preferred, or equivalent professional experience.
- Professional security management certification is preferred, such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), GIAC Defensible Security Certification (GDSA), Certified Secure Software Lifecycle Professional (CSSLP), Certified Ethical Hacker (CEH), etc.
- Solid knowledge of common information security management frameworks, such as Critical Security Controls, and NIST 800-53 and Cybersecurity Framework.
- Significant knowledge of application security concepts and technologies such as: SAST, DAST, SCA, IaC, cryptography, authn/authz, API security, etc.
- Strong understanding of cloud, application security, and software engineering principles.
- Experience with scripting automation (Python, PowerShell, Unix shell, JavaScript, TypeScript etc.).
- Proven experience and strong understanding of the DevSecOps and SAFE Agile working methodologies.
Wawa will provide reasonable accommodation to complete an application upon request, consistent with applicable law. If you require an accommodation, please contact our Associate Service Center at asc@wawa.com.
Wawa, Inc. is an equal opportunity employer. Wawa maintains a work environment in which Associates are treated fairly and with respect and in which discrimination of any kind will not be tolerated. In accordance with federal, state and local laws, we recruit, hire, promote and evaluate all applicants and Associates without regard to race, color, religion, sex, age, national origin, ancestry, familial status, marital status, sexual orientation or preference, gender identity or expression, citizenship status, disability, veteran or military status, genetic information, domestic or sexual violence victim status or any other characteristic protected by applicable law. Unlawful discrimination will not be a factor in any employment decision.
Soar with us at Wawa. We believe we can make life a little better every day – one smile, hoagie, or experience at a time. And there’s one secret ingredient that truly sets Wawa apart: Our Associates. At Wawa, you’ll be part of a caring team that’s dedicated to helping all of us fly high – together. We’re team players, day-brighteners, and go-getters: and we know that Wawa is a place where we can build skills to thrive and open doors to new career opportunities. We’re proud to be a part of a winning team of Associate owners who shape our success. We’re committed to helping our communities and one another at every turn, because we know that when we fly together, there’s no limit to how far we can go. Ready to be part of a team that helps you reach new heights? Join our flock and get ready to soar.
Job Description
Job Title: Application Security Engineer
Location: Corporate
Department: Information Technology
Job Summary: The Application Security Engineer is responsible for operating, supporting, maintaining, and improving the application security program by helping to ensure that security is built into all internally developed applications. This role executes all day-to-day operations, maintenance, functions, and capabilities relating to application security. Assist with the build and operation of application security tooling, automation, and engage with developers and product owners to solve application security problems. The role serves as a technical resource in the areas of secure software development at all stages of the SDLC and general information security best practices across all technology domains. The engineer is responsible for operating and improving Wawa’s application security processes to secure and maintain Wawa’s technology.
Principal Duties:
Operate and Support the Application Security Program
- Support security best practices in the software development lifecycle by way of working closely with developers and product owners to secure applications at all stages.
- Research, identify and communicate current and emerging application security threats and solutions.
- Maintain, and iterate on secure coding practices, policies, standards, and procedures.
- Test applications against security threats and vulnerabilities.
- Support application security vulnerability management.
- Create and deliver security presentations to technical and non-technical internal audiences.
- Identify security design gaps in existing and proposed applications and recommend changes or enhancements.
- Identify gaps and inefficiencies in the Application Security Program on a continual basis and propose solutions.
- Participate in and support application security reviews, penetration tests, and threat modeling.
- Contribute to the direction of internal security-focused programs.
Provide Strategic Support
- Assist in the development of metrics and reporting framework to measure the effectiveness of the program.
- Support the development and maintenance of Wawa’s technology security policies and standards and ensure their application to technology architectures.
- Assist with ensuring the ongoing compliance with both regulatory obligations and internally developed policies and standards.
- Provide support to Technology Security Incident Response team during cyber incidents.
Serve as Security Liaison
- Maintain internal networks among information security, information technology, and development teams to ensure support and alignment on initiatives.
- Maintain external networks consisting of industry peers, ecosystem partners, vendors, and other relevant parties to address common trends, findings, and cybersecurity risks.
- Act as technical resource for internal business teams and the IT department to plan, implement, and support new and existing software.
- Support audit and assessment process for IT including annual PCI audit, IT general controls review, and any other audits or assessments of security and general IT controls.
- Provide application security guidance on IT and business-related projects as required by the business. Participate in IT and security related projects.
- Work effectively with business units to facilitate applications security engineering requirements and advocate application security best practices.
Essential Skills:
- Ability to maintain and exude a positive attitude by committing to new ideas, being enthusiastic about work, and being helpful to, and thoughtful and considerate of, others across the organization.
- Proven experience securing custom software.
- Ability to work well individually and in a team environment.
- Ability to learn on the job.
- Ability to track task progress effectively.
- Experience working with teams of developers and product owners.
- Excellent written and verbal communication skills, interpersonal and collaborative skills, and the ability to communicate application security and risk-related concepts to diverse audiences.
- Poise and ability to act calmly and competently in high-pressure, high-stress situations.
- Must be a critical thinker, with strong problem-solving skills.
- Ability to manage multiple projects under strict timelines, as well as the ability to work well in a demanding, dynamic environment and meet overall objectives.
- Ability to engage in internal security technology projects and security remediation projects.
- Ability to understand large technology implementations spanning hundreds of physical and virtual environments.
- High level of personal integrity, as well as the ability to professionally handle confidential matters and show an appropriate level of judgment and maturity.
- High degree of initiative, dependability, and ability to work with little supervision while being resilient to change.
- Ability to be on-call 24x7x365 rotation for information security incidents.
Basic Requirements:
- Minimum of 2 years of experience in a complex technology environment, working in the application security engineering field.
- Advanced knowledge of containers and container security.
- Solid knowledge of cloud technology and security.
- Solid knowledge of Java programming.
- Basic knowledge of Golang programming.
- Basic knowledge of React and React Native programming.
- Experience with reading and writing enterprise software.
- Experience preventing and remediating software security flaws in enterprise software.
- Up-to-date knowledge of common security weaknesses and flaws, and how to prevent and remediate them.
- Advanced knowledge of OWASP guidance.
- Solid knowledge of web-related protocols (TCP/IP, HTTP, HTTPS, REST, etc.).
- Understanding of relevant legal and regulatory requirements, such as Payment Card Industry Data Security Standard.
- Degree in computer science preferred, or equivalent professional experience.
- Professional security management certification is preferred, such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), GIAC Defensible Security Certification (GDSA), Certified Secure Software Lifecycle Professional (CSSLP), Certified Ethical Hacker (CEH), etc.
- Solid knowledge of common information security management frameworks, such as Critical Security Controls, and NIST 800-53 and Cybersecurity Framework.
- Significant knowledge of application security concepts and technologies such as: SAST, DAST, SCA, IaC, cryptography, authn/authz, API security, etc.
- Strong understanding of cloud, application security, and software engineering principles.
- Experience with scripting automation (Python, PowerShell, Unix shell, JavaScript, TypeScript etc.).
- Proven experience and strong understanding of the DevSecOps and SAFE Agile working methodologies.
Wawa will provide reasonable accommodation to complete an application upon request, consistent with applicable law. If you require an accommodation, please contact our Associate Service Center at asc@wawa.com.
Wawa, Inc. is an equal opportunity employer. Wawa maintains a work environment in which Associates are treated fairly and with respect and in which discrimination of any kind will not be tolerated. In accordance with federal, state and local laws, we recruit, hire, promote and evaluate all applicants and Associates without regard to race, color, religion, sex, age, national origin, ancestry, familial status, marital status, sexual orientation or preference, gender identity or expression, citizenship status, disability, veteran or military status, genetic information, domestic or sexual violence victim status or any other characteristic protected by applicable law. Unlawful discrimination will not be a factor in any employment decision.
See all STEM OPT Application Security Engineer Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new STEM OPT Application Security Engineer Jobs.
Get Access To All JobsTips for Finding STEM OPT Authorization as an Application Security Engineer
Verify your degree CIP code first
Check that your degree's CIP code falls under an approved STEM category before applying. Computer science (11.xx), information security (11.1003), and engineering (14.xx) codes all qualify, but some interdisciplinary degrees don't. Confirm eligibility with your DSO before targeting roles.
Confirm E-Verify enrollment before accepting offers
Any employer who hires you on STEM OPT must be enrolled in E-Verify, not just willing to enroll. Ask recruiters directly and verify through the E-Verify employer search before signing anything. A non-enrolled employer disqualifies your extension regardless of role fit.
Target security teams at regulated industries
Financial services, healthcare, and defense contractors face strict compliance mandates that create standing demand for application security engineers. These industries file consistent STEM OPT training plans and are familiar with I-983 requirements, reducing delays after you receive an offer.
Build your I-983 training plan around AppSec milestones
Don't wait until offer acceptance to draft your I-983. Map your planned work to specific learning objectives tied to secure SDLC, penetration testing, or threat modeling. A well-prepared training plan speeds DSO approval and signals readiness to compliance-aware employers.
Use Migrate Mate to find E-Verify employers hiring AppSec engineers
Filter your search on Migrate Mate by employers with confirmed E-Verify enrollment and active application security roles. This cuts time spent vetting employers manually and surfaces companies already familiar with STEM OPT filing requirements.
File your extension request 90 days before OPT expiration
USCIS requires your STEM OPT extension application to be submitted at least 90 days before your initial OPT EAD expires. Missing this window means a gap in work authorization. Your DSO must recommend the extension in SEVIS before you file Form I-765.
Frequently Asked Questions
Does an Application Security Engineer role qualify for the STEM OPT extension?
Yes, if your degree is in a qualifying STEM field such as computer science, information security, or software engineering. The role itself must also provide structured learning tied to your degree, which you document in the I-983 training plan. Application security work typically maps cleanly to these requirements because it involves technically complex, degree-relevant skills. Your DSO makes the final eligibility determination based on your specific degree CIP code.
What E-Verify requirements does my employer need to meet for STEM OPT?
Your employer must be actively enrolled in E-Verify at the time you begin work on the STEM OPT extension. Enrollment after hiring does not satisfy this requirement retroactively. You can check employer enrollment status through the E-Verify employer search tool. The employer must also sign your I-983 training plan, confirming they will provide the documented learning experience for the full extension period.
What goes into the I-983 training plan for an Application Security Engineer?
The I-983 requires you to describe specific training goals tied to your STEM degree, the skills you'll develop, and how the employer will supervise and evaluate your progress. For an application security role, this typically includes objectives around secure code review, vulnerability assessment, threat modeling, or incident response. The employer's designated supervisor signs the plan, and you submit it to your DSO before the extension begins. You also file an evaluation update at the 12-month mark.
How does cap-gap protection apply if my employer files an H-1B petition while I'm on STEM OPT?
If your employer files an H-1B visa petition before your STEM OPT EAD expires and you're selected in the lottery, cap-gap automatically extends your work authorization through September 30 of that fiscal year. You don't need to file separately for cap-gap. Your I-20 should be updated by your DSO to reflect the cap-gap period. USCIS confirms the underlying rules governing this extension, so verify your specific dates with your DSO.
Where can I find Application Security Engineer jobs where employers already understand STEM OPT?
Migrate Mate lists application security roles filtered by employers enrolled in E-Verify, which is the baseline requirement for your STEM OPT extension. Searching there saves time compared to screening employers manually. Look for roles at companies in regulated sectors like finance or healthcare, where dedicated security teams and compliance infrastructure mean faster I-983 processing and less employer education required on your end.