Application Security Engineer Jobs in USA with Visa Sponsorship
Application Security Engineer roles are among the most consistently sponsored positions in tech. Most employers file H-1B visa or O-1 visa petitions for these roles, and a relevant bachelor's degree in computer science, cybersecurity, or a related field satisfies the specialty occupation requirement with minimal friction. For detailed occupation requirements, see the O*NET profile.
Find Application Security Engineer JobsOverview
Showing 5 of 174+ Application Security Engineer jobs
See all 174+ Application Security Engineer Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Application Security Engineer roles.
Get Access To All JobsJob Function: Research & Development
Location:
Stafford, TX, US, 77477
Work Location (for field-based positions):
Work Flexibility: Hybrid
Pay Range: $101,800 - $132,300
Job ID: 5566
Why KARL STORZ?
At KARL STORZ, we are driven by innovation and a commitment to improving patient outcomes through cutting-edge medical technology. As a global leader in endoscopy and medical imaging, we offer an environment where collaboration, technical excellence, and continuous learning are highly valued. Join a team where your cybersecurity expertise will directly contribute to the development of secure, compliant, and life-changing healthcare technologies.
Position Summary
The Application Security Engineer III serves as the technical lead for cybersecurity compliance and secure product development initiatives, with primary responsibility for achieving and maintaining Department of Defense (DoD) Authorization to Operate (ATO) certifications under the Risk Management Framework (RMF). This role partners closely with Software Engineering, Systems Engineering, Quality, Regulatory, and Product Management teams to ensure products meet cybersecurity requirements throughout the development lifecycle.
Key Responsibilities
DoD RMF & ATO Leadership
- Lead and maintain DoD Authorization to Operate (ATO) certifications.
- Serve as the primary cybersecurity contact for DoD-related projects.
- Manage RMF compliance activities, including STIG and SCAP scanning, POA&M management, and risk mitigation planning.
- Author and maintain cybersecurity documentation, risk analyses, and compliance reports.
- Support certification audits, renewals, and customer-facing cybersecurity reviews.
Product Security & Verification
- Verify cybersecurity requirements through testing, documentation, and validation activities.
- Partner with engineering teams to implement secure development practices.
- Support threat modeling, vulnerability management, and security testing throughout the SDLC.
- Participate in product security reviews and provide risk mitigation recommendations.
DevSecOps & Security Operations
- Design and maintain DevSecOps pipelines with automated security testing and vulnerability scanning.
- Support secure CI/CD practices and compliance monitoring.
- Establish and maintain cybersecurity lab environments and test infrastructure.
Cross-Functional Collaboration
- Collaborate with R&D, Quality, Regulatory, IT, Operations, and Product Management teams.
- Communicate cybersecurity risks, requirements, and recommendations to technical and non-technical stakeholders.
- Participate in customer meetings, technical reviews, and occasional on-site visits.
Qualifications
Required
- Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related technical field.
- 5+ years of cybersecurity experience (4+ years with a Master's degree).
- Experience supporting application, product, or embedded cybersecurity in regulated industries such as medical devices, defense, or aerospace.
- Hands-on experience with DoD RMF, STIGs, SCAP tools, and POA&M management.
- Knowledge of NIST frameworks, including NIST 800-53 and NIST 800-171.
- Experience with secure software development, vulnerability management, risk assessment, and DevSecOps practices.
- Experience with Windows and Linux hardening, network security, and system compliance validation.
- Strong communication, analytical, organizational, and problem-solving skills.
Preferred
- Experience obtaining or maintaining DoD ATO certifications.
- Knowledge of FDA cybersecurity guidance and medical device security standards.
- Certifications such as CISSP, Security+, CEH, or GSEC.
- Experience with cloud security, container security, and automated testing frameworks.
- Experience working in Linux, Windows Server, virtualized environments, and network security architectures.
- Master's degree in a related technical discipline.
Additional Information
Travel: Up to 10%
Physical Requirements: Ability to sit for extended periods and lift equipment up to 20 pounds occasionally.
Work Environment: Fast-paced, collaborative environment supporting highly regulated medical technology products.
Eligible Employee Benefits
- Medical / Dental / Vision including a state-of-the-art wellness program and pet insurance, too!
- 3 weeks vacation, 11 holidays plus paid sick time
- Up to 8 weeks of 100% paid company parental leave; includes maternal/paternal leave, adoption, and fostering of a child.
- 401(k) retirement savings plan providing a match of 60% of the employee’s first 6% contribution (up to IRS limits)
- Section 125 Flexible Spending Accounts
- Life, STD, LTD & LTC Insurance
- We prepay your tuition up to $5,250 per year! - Tuition pre-reimbursement
- Fitness reimbursement of up to $200 annually
- And much more!
KARL STORZ reserves the right to change or modify the employee’s job description whether orally or in writing, at any time during the employment relationship. Additionally, KARL STORZ, through its supervisors, may require an employee to perform duties outside their normal description within the sole discretion of the supervisor. Employees must comply with all applicable KARL STORZ policies and procedures.
KARL STORZ is committed to creating an inclusive space where employees are valued for their skills and unique experiences. To achieve this goal, we are committed to diverse voices, and all applicants will receive consideration without regard to race, color, sex, national origin, disability, veteran status, or any other protected characteristic. KARL STORZ is also committed to providing reasonable accommodations during our recruitment process. Should you need assistance or accommodation please email us at taoperations@karlstorz.com.
Job Function: Research & Development
Location:
Stafford, TX, US, 77477
Work Location (for field-based positions):
Work Flexibility: Hybrid
Pay Range: $101,800 - $132,300
Job ID: 5566
Why KARL STORZ?
At KARL STORZ, we are driven by innovation and a commitment to improving patient outcomes through cutting-edge medical technology. As a global leader in endoscopy and medical imaging, we offer an environment where collaboration, technical excellence, and continuous learning are highly valued. Join a team where your cybersecurity expertise will directly contribute to the development of secure, compliant, and life-changing healthcare technologies.
Position Summary
The Application Security Engineer III serves as the technical lead for cybersecurity compliance and secure product development initiatives, with primary responsibility for achieving and maintaining Department of Defense (DoD) Authorization to Operate (ATO) certifications under the Risk Management Framework (RMF). This role partners closely with Software Engineering, Systems Engineering, Quality, Regulatory, and Product Management teams to ensure products meet cybersecurity requirements throughout the development lifecycle.
Key Responsibilities
DoD RMF & ATO Leadership
- Lead and maintain DoD Authorization to Operate (ATO) certifications.
- Serve as the primary cybersecurity contact for DoD-related projects.
- Manage RMF compliance activities, including STIG and SCAP scanning, POA&M management, and risk mitigation planning.
- Author and maintain cybersecurity documentation, risk analyses, and compliance reports.
- Support certification audits, renewals, and customer-facing cybersecurity reviews.
Product Security & Verification
- Verify cybersecurity requirements through testing, documentation, and validation activities.
- Partner with engineering teams to implement secure development practices.
- Support threat modeling, vulnerability management, and security testing throughout the SDLC.
- Participate in product security reviews and provide risk mitigation recommendations.
DevSecOps & Security Operations
- Design and maintain DevSecOps pipelines with automated security testing and vulnerability scanning.
- Support secure CI/CD practices and compliance monitoring.
- Establish and maintain cybersecurity lab environments and test infrastructure.
Cross-Functional Collaboration
- Collaborate with R&D, Quality, Regulatory, IT, Operations, and Product Management teams.
- Communicate cybersecurity risks, requirements, and recommendations to technical and non-technical stakeholders.
- Participate in customer meetings, technical reviews, and occasional on-site visits.
Qualifications
Required
- Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related technical field.
- 5+ years of cybersecurity experience (4+ years with a Master's degree).
- Experience supporting application, product, or embedded cybersecurity in regulated industries such as medical devices, defense, or aerospace.
- Hands-on experience with DoD RMF, STIGs, SCAP tools, and POA&M management.
- Knowledge of NIST frameworks, including NIST 800-53 and NIST 800-171.
- Experience with secure software development, vulnerability management, risk assessment, and DevSecOps practices.
- Experience with Windows and Linux hardening, network security, and system compliance validation.
- Strong communication, analytical, organizational, and problem-solving skills.
Preferred
- Experience obtaining or maintaining DoD ATO certifications.
- Knowledge of FDA cybersecurity guidance and medical device security standards.
- Certifications such as CISSP, Security+, CEH, or GSEC.
- Experience with cloud security, container security, and automated testing frameworks.
- Experience working in Linux, Windows Server, virtualized environments, and network security architectures.
- Master's degree in a related technical discipline.
Additional Information
Travel: Up to 10%
Physical Requirements: Ability to sit for extended periods and lift equipment up to 20 pounds occasionally.
Work Environment: Fast-paced, collaborative environment supporting highly regulated medical technology products.
Eligible Employee Benefits
- Medical / Dental / Vision including a state-of-the-art wellness program and pet insurance, too!
- 3 weeks vacation, 11 holidays plus paid sick time
- Up to 8 weeks of 100% paid company parental leave; includes maternal/paternal leave, adoption, and fostering of a child.
- 401(k) retirement savings plan providing a match of 60% of the employee’s first 6% contribution (up to IRS limits)
- Section 125 Flexible Spending Accounts
- Life, STD, LTD & LTC Insurance
- We prepay your tuition up to $5,250 per year! - Tuition pre-reimbursement
- Fitness reimbursement of up to $200 annually
- And much more!
KARL STORZ reserves the right to change or modify the employee’s job description whether orally or in writing, at any time during the employment relationship. Additionally, KARL STORZ, through its supervisors, may require an employee to perform duties outside their normal description within the sole discretion of the supervisor. Employees must comply with all applicable KARL STORZ policies and procedures.
KARL STORZ is committed to creating an inclusive space where employees are valued for their skills and unique experiences. To achieve this goal, we are committed to diverse voices, and all applicants will receive consideration without regard to race, color, sex, national origin, disability, veteran status, or any other protected characteristic. KARL STORZ is also committed to providing reasonable accommodations during our recruitment process. Should you need assistance or accommodation please email us at taoperations@karlstorz.com.
See all 174+ Application Security Engineer Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Application Security Engineer roles.
Get Access To All JobsTips for Finding Visa Sponsorship as an Application Security Engineer
Target security-mature employers
Companies with dedicated security teams, large fintechs, cloud providers, defense contractors, and healthcare systems, are far more likely to sponsor than startups where security is still a shared responsibility. Sponsorship infrastructure already exists at these organizations.
Get certified before you apply
OSCP, CISSP, CEH, or AWS Security certifications meaningfully strengthen your H-1B petition. USCIS scrutinizes specialty occupation claims, and certifications alongside your degree reduce the risk of a Request for Evidence on this role.
Lead with technical depth in your resume
Vague descriptions like 'performed security assessments' won't land interviews. Specify tools, frameworks, and measurable outcomes. Employers filing visa petitions want documented evidence of specialized expertise, not generalist security experience.
Understand your degree field matters
A computer science, cybersecurity, or software engineering degree maps cleanly to this role. Degrees in unrelated fields require stronger supporting evidence, work history, certifications, and employer attestation, to satisfy the specialty occupation standard.
Don't overlook cap-exempt employers
Universities, nonprofit research institutions, and government-affiliated labs are cap-exempt H-1B employers. If you miss the lottery, these organizations can file for you year-round. Application security roles exist across all of them.
Time your application cycle strategically
H-1B registration opens in March. Starting your job search in December through February gives employers enough lead time to register on your behalf. Late outreach significantly reduces your chances of being included in that cycle.
Frequently Asked Questions
Does Application Security Engineer qualify as a specialty occupation for H-1B purposes?
Yes. Application security engineering consistently qualifies as a specialty occupation because the role requires at minimum a bachelor's degree in computer science, cybersecurity, information systems, or a closely related field. USCIS has approved H-1B visa petitions for this title extensively, and the technical complexity of the work supports the specialty occupation argument well.
How common is visa sponsorship for Application Security Engineer roles?
Sponsorship is relatively common for this title compared to many other tech roles. Security talent is scarce, and employers filing LCAs for security engineers appear regularly in Department of Labor disclosure data. Mature tech companies, financial institutions, and large healthcare organizations account for the majority of filings. You can browse currently sponsoring employers on Migrate Mate.
My degree is in a field unrelated to security or computer science. Can I still get an H-1B for this role?
It's harder but not disqualifying. USCIS allows three years of progressive, specialized work experience to substitute for one year of formal education. If your degree field is unrelated, you'll need strong documentation: detailed employer letters, a credentials evaluation, and certifications like OSCP or CISSP that demonstrate specialized knowledge. A Request for Evidence is more likely in this scenario.
Is the O-1A a realistic alternative to the H-1B for application security engineers?
For engineers with a strong track record, yes. Published research, CVE discoveries, conference presentations at DEF CON or Black Hat, open-source tool contributions with measurable adoption, or significant media coverage of your security work can each satisfy O-1A criteria. It requires documented evidence, but security professionals often have more qualifying material than they realize.
What should I expect during the H-1B petition process for this role?
Expect your employer to file a Labor Condition Application with the DOL before submitting Form I-129 to USCIS. For application security roles, Requests for Evidence sometimes challenge the specialty occupation determination or the connection between your degree field and the specific job duties. Premium processing, which adjudicates within 15 business days, is worth requesting to reduce uncertainty.
What is the prevailing wage requirement for sponsored Application Security Engineer jobs?
U.S. employers sponsoring a visa must pay at least the prevailing wage, which is what workers in the same role, area, and experience level typically earn. The Department of Labor sets this rate to make sure companies aren't hiring foreign workers simply because they'd accept lower pay than a U.S. worker. It varies by job title, location, and experience. You can look up current prevailing wage rates for any occupation and location using the OFLC Wage Search page.