Application Security Engineer

• Ability to maintain and exude a positive attitude by committing to new ideas, being enthusiastic about work, and being helpful to, and thoughtful and considerate of, others across the organization.
• Proven experience securing custom software.
• Ability to work well individually and in a team environment.
• Ability to learn on the job.
• Ability to track task progress effectively.
• Experience working with teams of developers and product owners.
• Excellent written and verbal communication skills, interpersonal and collaborative skills, and the ability to communicate application security and risk-related concepts to diverse audiences.
• Poise and ability to act calmly and competently in high-pressure, high-stress situations.
• Must be a critical thinker, with strong problem-solving skills.
• Ability to manage multiple projects under strict timelines, as well as the ability to work well in a demanding, dynamic environment and meet overall objectives.
• Ability to engage in internal security technology projects and security remediation projects.
• Ability to understand large technology implementations spanning hundreds of physical and virtual environments.
• High level of personal integrity, as well as the ability to professionally handle confidential matters and show an appropriate level of judgment and maturity.
• High degree of initiative, dependability, and ability to work with little supervision while being resilient to change.
• Ability to be on-call 24x7x365 rotation for information security incidents.

• Minimum of 2 years of experience in a complex technology environment, working in the application security engineering field.
• Advanced knowledge of containers and container security.
• Solid knowledge of cloud technology and security.
• Solid knowledge of Java programming.
• Basic knowledge of Golang programming.
• Basic knowledge of React and React Native programming.
• Experience with reading and writing enterprise software.

• Experience preventing and remediating software security flaws in enterprise software.
• Up-to-date knowledge of common security weaknesses and flaws, and how to prevent and remediate them.
• Advanced knowledge of OWASP guidance.
• Solid knowledge of web-related protocols (TCP/IP, HTTP, HTTPS, REST, etc.).
• Understanding of relevant legal and regulatory requirements, such as Payment Card Industry Data Security Standard.
• Degree in computer science preferred, or equivalent professional experience.
• Professional security management certification is preferred, such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), GIAC Defensible Security Certification (GDSA), Certified Secure Software Lifecycle Professional (CSSLP), Certified Ethical Hacker (CEH), etc.
• Solid knowledge of common information security management frameworks, such as Critical Security Controls, and NIST 800-53 and Cybersecurity Framework.
• Significant knowledge of application security concepts and technologies such as: SAST, DAST, SCA, IaC, cryptography, authn/authz, API security, etc.
• Strong understanding of cloud, application security, and software engineering principles. 
• Experience with scripting automation (Python, PowerShell, Unix shell, JavaScript, TypeScript etc.).
• Proven experience and strong understanding of the DevSecOps and SAFE Agile working methodologies.

Wawa will provide reasonable accommodation to complete an application upon request, consistent with applicable law. If you require an accommodation, please contact our Associate Service Center at asc@wawa.com.

Wawa, Inc. is an equal opportunity employer. Wawa maintains a work environment in which Associates are treated fairly and with respect and in which discrimination of any kind will not be tolerated. In accordance with federal, state and local laws, we recruit, hire, promote and evaluate all applicants and Associates without regard to race, color, religion, sex, age, national origin, ancestry, familial status, marital status, sexual orientation or preference, gender identity or expression, citizenship status, disability, veteran or military status, genetic information, domestic or sexual violence victim status or any other characteristic protected by applicable law. Unlawful discrimination will not be a factor in any employment decision.