Do you have a passion for Application Security in the AI era? Are you energized to design and test to build secure applications in a rapidly changing application technology landscape?
State Fund’s Information Technology – Systems Engineering unit is seeking a highly skilled Lead Application Security Engineer to help secure business-critical web applications, cloud, and emerging AI-enabled applications. In this role, you’ll work closely with developers, architects, and technology leaders to identify risks, improve secure development practices, and help protect the systems that support California’s workforce.
Key Responsibilities:
- Lead application security initiatives using Secure SDLC, threat modeling, OWASP, AI TRiSM and NIST best practices.
- Perform application security architecture reviews, application code reviews, vulnerability assessments, and application penetration testing activities.
- Drive BRD, TDD, SDD, design, and code reviews with a security-risk lens; estimate effort for SAST, DAST, IAST, and application penetration-testing initiatives.
- Own and advance AI powered application security strategy to safeguard applications, micro-segmentation, microservices, APIs, and UI components.
- Execute Quality Agile + DevSecOps transformation activities to improve end-to-end application security across the enterprise.
- Perform application vulnerability exploitation, application security audits, and application penetration testing to identify and mitigate high-risk exposures.
Desired Qualification:
- 5+ years of application security experience, including securing applications with privacy, and regulatory compliance (PII, PHI, PCI).
- compliance (PII, PHI, PCI).
- Hands-on experience with SAST, DAST, IAST, application penetration testing, and fuzz testing tools used by ethical hackers for the AI era.
- Exposure to one or more application development frameworks: C#, .NET, Java, jQuery, AngularJS, ReactJS, GraphQL, Web APIs/Services, XML and Agentic AI.
- Strong knowledge of application threat modeling, continuous protection via RASP, ADR or unified security platform and AI Security methodologies.
- Ability to research emerging application security technologies, zero-day vulnerabilities, AI TRiSM framework and best practices.
- Experience securing Web, Cloud, Agentic AI applications and Ethical Hacking, or Application PenTest certifications are a plus.
- Experience implementing application security controls and application security testing solutions through the software development lifecycle – Secure SDLC.
- Working knowledge of JIRA or similar defect-tracking systems and Work Breakdown Structures.
- Excellent communication, presentation and collaboration skills.
Looking for insight into claims? Learn more about our purpose, growth, and support at State Fund Here: https://www.youtube.com/watch?v=T8hSmsjuB3Y&list=PLl-QLNcYL6hTN64WADR_IIXgKDBvunK4a&index=2
If you have a bachelor’s degree, please attach a copy with your application (transcripts with a conferral date are acceptable).
Working at State Fund offers EXCELLENT benefits including:
- Alternate Work Schedule options
- On-the-job training
- Various health, dental and vision plans to choose from
- Retirement plans (CalPERS, 401(k) and 457 Deferred Compensation Plans)
- 11 Paid Holidays
- Vacation and Sick Leave
- Employee Assistance Program
- Professional Development Days
- Personal Holidays
- Tuition Assistance/Reimbursement
- Dependent Scholarship Program
- Leadership Training
- Mentoring Program
- Transit Pass Program
- AND MORE
Do you need help with the state application process? Please view this short tutorial video:
https://scif.wistia.com/medias/8g6eazzxjk
SALARY: $8,625- $11,557; New to State candidates will be hired into the minimum salary of the classification or minimum of alternate range when applicable.
LOCATION: California
CLASSIFICATION: INFORMATION TECHNOLOGY SPECIALIST II
FINAL FILING DATE: 07/11/2026
US
