Senior Application Security Engineer

Are you ready to join a growing team that puts a premium on productivity and has an award-winning culture centered around transforming talented employees into effective business leaders? Then BHG Financial is the place for you. 
In 2001, we started with an idea, an opportunity, and $25,000. Back then, our focus was strictly 
on serving those in the medical industry. With healthcare in our heritage, we soon expanded 
to serve high-earning professionals in many 
other industries, providing all with leading-edge financial solutions, including our extensive network of community banks.
Today, BHG Financial has firmly established 
its legacy as a leader in the financial services space. Founded on the philosophy of a better way to borrow, we are dedicated to helping accomplished professionals, small businesses, and institutions build upon their success through innovative financial solutions, a hassle-free process, and personalized concierge service.
Our relentless commitment to the success of our customers is part of what has made BHG Financial thrive. We take a 360-degree view of our customers to tailor the best solutions for their financial aspirations. Today's professionals have multiple sources of income, not just their paycheck. Therefore, it is essential to factor those in when making responsible lending decisions. Our continued focus on data, analytics, and proprietary modeling has enabled faster funding for our customers.  
From business to personal loans to relationships with community banks, the country’s top professionals and business owners rely on us for our exceptional financial solutions and concierge service to continue their success and legacy.    

Who You AreBHG Financial is looking for a Security Engineer who can lead AppSec initiatives while collaborating closely with developers and cross-functional security teams. The role focuses on vulnerability assessment, secure coding guidance, and integrating security throughout the SDLC. Candidates should also have a working knowledge of other security domains to serve as a flexible contributor across the security organization.

What You'll Do

• Lead application vulnerability assessments using SAST, DAST, and SCA tools; validate and triage findings to ensure accuracy and actionable results.
• Support container and cloud-native security efforts, including scanning container images, assessing container configurations, and advising on secure container orchestration practices.
• Partner closely with developers and software engineers to prioritize, remediate, and prevent vulnerabilities across applications, dependencies, and codebases.
• Promote and reinforce secure coding practices through guidance, documentation, and hands-on collaboration.
• Define and communicate technical security requirements and guidelines for new initiatives, features, and architecture changes.
• Stay current with emerging security threats, trends, and research; recommend appropriate mitigation strategies and technology improvements.
• Work with compliance and technical teams to address deficiencies identified during assessments, audits, or regulatory examinations.
• Assist in generating, tracking, and reporting key metrics for leadership and security governance.
• Participate in Incident Response activities as needed
• Participate in the security on-call support rotation as required.

What You'll Need

• 3+ years of experience in a technical security or IT role with a strong focus on application security.
• Hands-on experience with SAST, DAST, and SCA tools
• Knowledge of container security concepts, including container image scanning, secure image pipelines, and common misconfigurations in containerized environments (Docker, Kubernetes, etc.).
• Deep understanding of application security principles and secure development practices, including authentication, authorization, session management, input validation, secrets management, and API security.
• Strong familiarity with common web application vulnerabilities (e.g., XSS, CSRF, SQL injection, SSRF, insecure deserialization) and the ability to explain, validate, and reproduce them.
• Proven ability to provide actionable remediation guidance to developers and engineering teams, balancing risk with business and technical realities.
• Experience with vulnerability validation, risk assessment, and prioritization, particularly in complex environments with multiple applications and tech stacks.
• Working knowledge of broader security technologies and domains such as endpoint security, vulnerability management, network security, SIEM, MFA/IAM/PAM, PKI, security automation, cloud security controls, NAC, encryption, DLP, and firewalls.
• Ability to maintain strict confidentiality.
• Excellent writing, organizational, interpersonal and communication skills.