Cybersecurity Application Security Engineer

Position Overview

Nelnet is a diversified and innovative company committed to enriching lives through service in education, financial, renewable energy, and more. With over 40 years of industry expertise, Nelnet is dedicated to creating opportunities where people live, learn, and work. We are seeking a highly skilled Application Security Engineer to partner with engineering, cloud, and product teams. In this role, you will safeguard our applications, services, and AI-driven components using hands-on technical testing and scalable automation throughout the development lifecycle.

Key Responsibilities

• Manual Source Code Review
• SAST/DAST scanning
• Expand the Security Champions program
• Develop automated source code review processes
• Work with product teams to ensure secure SDLC processes are in place
• Provide detailed vulnerability reports to businesses

Required Qualifications

• 2–4 years of hands-on application security experience
• Experience integrating security tooling and automated checks into CI/CD pipelines
• Familiarity with OWASP Top 10 and web testing methodologies
• Experience assessing and communicating risks to management and engineering staff
• Experience with technical report writing and communication
• Strong manual code review experience in at least one major language (Java, JavaScript/TypeScript, C#, PHP, etc.)
• Solid threat-modeling expertise (STRIDE, attack trees, misuse cases) for traditional systems and AI/LLM-integrated features
• Proficiency with SAST, SCA, DAST, pentesting, container scanners, secrets-detection tools, and ideally AI-security scanning platforms
• Scripting/automation skills (Python, Bash, Node) for building custom tooling and automating processes
• Good understanding of AI/LLM attack surfaces including prompt injection, insecure output handling, model-data leakage, and RAG vulnerabilities
• Strong knowledge of web/API security concepts (session management, secure storage, transport security)
• Excellent organizational, presentation, verbal, and written communication skills
• Aptitude for self-study, setting long-term goals, and adapting to changing technology and business landscapes
• Ability to tailor communication to diverse audiences

Preferred Qualifications

• Experience performing secure code reviews or building internal developer tooling
• Previous work with AI or LLM-integrated applications, model security, or prompt safety
• Experience with mobile security, reverse engineering, or platform-specific secure coding
• Certifications such as OSWE, OSCP, GWAPT, GCSA, GCPN, or ML security certs (beneficial)
• Ability to mentor junior developers/engineers in secure design and coding practices

Benefits & Perks

• Hybrid Work Option: Remote work available for part of the week with in-office collaboration three days per week
• Compensation: $90,000–$125,000 annually, depending on experience
• Medical, Dental & Vision coverage
• HSA and FSA benefits
• 401K/Student Loan Repayment
• Life & AD&D Insurance
• Employee Assistance Program
• Employee Stock Purchase Program
• Tuition Reimbursement
• Performance-Based Incentive Pay
• Short- and Long-Term Disability coverage
• Robust Wellness Program