Application Security Engineer

At Everus, employees come first. We provide great pay, benefits and growth opportunities to more than 9,000 highly skilled team members across the country who are united by the common goal of safely Building America's Future. We take great pride in the work our employees do each day, which drives our success as one of the Top 12 largest specialty contractors in the nation, and we will ensure you have the tools, training and opportunities for a successful career. We look forward to having you on the team!

Everus Construction Group is hiring a hands-on Application Security Engineer to build, run, and continuously improve the security tooling and code review practices across our software development lifecycle (SDLC) - including the growing surface of AI-assisted ("vibe") coding from tools like GitHub Copilot, Cursor, and Claude Code.

This is an engineering role, not a policy role. You'll spend your time in pipelines, repositories, and code - wiring up scanners, writing custom rules, reviewing pull requests, and partnering with developers on remediation. Policy and governance work exists, but it's downstream of the technical work you produce. Our existing GRC and security leadership functions own the audit-facing artifacts; you own the things that actually run in production.

We are a recently spun-off public company (NYSE: ECG) building modern AppSec capabilities from the ground up. You will not inherit a mature program - which means you get to make the technical decisions that shape how we build software for the next decade.

Responsible for understanding, upholding, and promoting the Everus 4EVER Strategy.
Employees | Value | Execution | Relationships

• A working knowledge of Information Technology at a level normally acquired through completion of a Bachelor's degree in Information Technology, Cybersecurity, Computer Science or related field; and
• Four years' experience in application security, DevSecOps, or a software engineering role with substantial security responsibility

SDLC Security Tooling & Automation (~50%)

• Deploy, integrate, and tune SAST, DAST, SCA, IaC, container, and secrets-scanning tooling across our CI/CD pipelines (GitHub Actions, Azure DevOps)
• Write and maintain custom rules (Semgrep, CodeQL, or equivalent) tailored to our codebases and the recurring issues we actually see
• Build security gates, pre-commit hooks, and PR automation that catch issues early without breaking developer flow
• Develop and maintain SBOM generation and dependency-update automation (Dependabot, Renovate, or custom)
• Automate secret rotation and detection workflows, including post-leak revocation paths
• Build dashboards and metrics on findings, MTTR, coverage, and pipeline health
• Create secure-by-default project templates, starter repos, and reusable workflows for our development teams
• Continuously evaluate and replace tooling - we expect this stack to evolve

Hands-On Code Review & Developer Partnership (~25%)

• Perform manual security code reviews on high-risk changes, new applications, and pre-production releases
• Conduct lightweight threat modeling on new applications and major changes - focused on producing actionable findings, not artifacts
• Pair with developers on remediation, including writing the fix when that's the fastest path
• Review architecture for in-house applications, integrations, and Azure-hosted workloads (App Service, Functions, Key Vault, Storage, AI services)
• Triage, validate, and route findings from automated scanners and external researchers
• Maintain reusable secure-coding patterns and code samples developers can copy

AI-Generated Code Detection & Guardrails (~15%)

• Build technical guardrails around AI coding tool usage in our repositories - what gets allowed, what gets flagged, what gets blocked
• Implement detection for common AI-generated insecurity patterns (insecure deserialization, missing authz, hardcoded secrets, weak crypto, prompt-injection-prone patterns in agentic code)
• Stand up telemetry to attribute and assess AI-generated code, especially in SOX-relevant systems
• Build automated PR review tooling that flags AI-generated code requiring deeper human review
• Apply the same scanning and review rigor to AI features in our own applications (RAG pipelines, agents, LLM-integrated workflows like our internal ESIconnect platform)
• Provide technical input to the policy and governance work owned by Security Leadership and GRC - but you build, they publish

Vulnerability Operations (~10%)

• Run the application vulnerability backlog: triage, prioritization, exception workflow, SLAs
• Contribute to incident response for application-layer events
• Support audit and SOX evidence collection by ensuring tooling output is retainable and queryable - the goal is automation, not screenshots

• Strong working code in at least one of: Python, JavaScript/TypeScript, C#/.NET, or Go - you can write tooling, not just read it
• Production experience integrating security scanners into CI/CD (GitHub Actions or Azure DevOps preferred); you've configured them, tuned them, and replaced them
• Hands-on experience writing custom rules in Semgrep, CodeQL, or a comparable engine
• Working knowledge of OWASP Top 10, common vulnerability classes, and how they manifest in modern frameworks
• Personal, hands-on experience using AI coding tools (Copilot, Cursor, Claude Code, or equivalent) - you can speak credibly about what they do well and where they fail
• Working knowledge of cloud security fundamentals (Azure preferred - Entra ID, Key Vault, App Service, Storage, Defender for Cloud)
• Comfort with Git, branching strategies, and modern PR-driven workflows

• Salary: $118,020 - $147,520
• Annual short-term incentive bonus of up to 30% of eligible wages based on eligibility and company goal achievement.
• Medical insurance (health savings account), including free programs Hinge Health and Omada
• Enhanced mental health and work-life services through Lyra Health
• Virtual care through Doctor on Demand
• Prescription delivery service
• Dental insurance
• Vision insurance
• Life insurance for employees, spouses, and dependents
• Accidental death and dismemberment (AD&D) insurance
• Flexible spending accounts
• 401(k) plan with matching contribution and retirement contribution
• Hospital Insurance
• Accident Insurance
• Critical Illness Insurance
• Disability insurance
• Sick leave
• Vacation
• 11 paid holidays
• Flexible work hours, where feasible
• Employee discount programs

• Background check, MVR and drug screen are required
• May be required to maintain a valid driver's license

(This position may close early if a sufficient number of applications are received.)

Current Everus employees: Ask HR about our referral program!