Application Security Engineer

Hi, We're Centerfield!

Supercharged customer acquisition. Centerfield delivers outcome-based digital marketing solutions and personalized omnichannel experiences for the world’s leading brands. Powered by our proprietary Dugout platform, Centerfield acquires customers at scale for leading residential service, insurance, e-commerce, and B2B brands. Centerfield’s digital experiences and digital brands, such as Business.com and BroadbandNow.com, reach more than 150 million in-market shoppers annually. Centerfield is headquartered in Silicon Beach and is proud to be recognized by Built in LA as a Best Place to Work in Los Angeles.

The Opportunity...

Centerfield is building and operating modern, cloud-based products across multiple business verticals and technology stacks. We are looking for an Application Security Engineer to partner with Engineering, Product, and Security to make security an everyday part of how we build and ship software.

This role will drive a practical, developer-friendly AppSec program across teams and codebases, improving risk posture while enabling fast delivery. You will establish secure-by-default patterns, scale security testing through automation, and help Centerfield maintain an evidence-ready posture for SOC 2, HIPAA, and PCI-DSS.

Key outcomes in the first 6–12 months:

• Establish a consistent AppSec operating model across engineering teams (intake, triage, remediation, exceptions, reporting).

• Increase coverage and signal quality for SAST, SCA, secrets scanning, and DAST across CI/CD.

• Improve mean-time-to-remediate for critical findings and reduce repeat vulnerabilities through root-cause fixes.

• Make threat modeling and design reviews a standard part of delivering new capabilities.

How You'll Contribute...

• Build and run the AppSec program: Define standards, workflows, and SLAs for identifying, prioritizing, and remediating application vulnerabilities.

• Embed security into the SDLC: Integrate security checks into build and deployment pipelines (e.g., GitHub/Jenkins) and make results actionable for engineering teams.

• Security testing at scale: Operate and tune AppSec tooling for SAST, DAST, and SCA, and ensure teams can consistently scan code and dependencies.

• Threat modeling & design reviews: Lead threat modeling sessions and architecture reviews for new services and major changes to identify risks early.

• Secure code reviews: Partner with engineering to review high-risk changes and coach teams on secure coding patterns.

• AI security testing: Design and execute security testing for AI infrastructure and workflows, including access controls for AI agents and LLM-focused vulnerability testing (e.g., hallucination and misinformation risks, data leakage and exfiltration, prompt injection, jailbreaks, and toxicity or abuse content generation).

• Vulnerability management: Own the end-to-end lifecycle including intake, triage, prioritization, remediation guidance, verification, and root cause analysis.

• Tooling & automation: Manage and continuously improve AppSec tools and workflows (e.g., Mend.io, SonarQube, and related ecosystem). Use scripting and APIs (Python preferred) to automate repetitive tasks and reporting.

• Developer enablement: Create lightweight training, office hours, and a Security Champions model that scales across teams.

• Cross-functional partnership: Work closely with Software Engineering, DevOps, Security, and Security Operations to align detection, response, and hardening efforts.

What We're Looking For...

• 7+ years of experience in software engineering and/or application security, with meaningful ownership of an AppSec program or function.

• Strong understanding of modern web application security, common attack patterns, and secure design principles.

• Experience building security into CI/CD and developer workflows, including SAST, DAST, SCA, Secrets scanning, Container and/or IaC scanning.

• Hands-on experience working with multiple stacks such as Node/Next.js, C#/.NET, Python, and PHP.

• Practical cloud and platform underst