Application Security Engineer (AI)

Location: Mexico City, Mexico; hybrid model with in-office presence at least two days per week

Company

Bain & Company is a global consulting firm with a Technology Solutions Group focused on technology and engineering.

What you will do

• Own and operate application security scanning capabilities, including SAST, SCA, secret detection, and Infrastructure-as-Code scanning.
• Lead the deployment and adoption of Wiz Code across development teams and CI/CD pipelines.
• Define secure coding standards and policy-as-code practices, and integrate security scanning into IDEs, pull requests, and CI/CD workflows.
• Configure scanning rules, improve detection quality, minimize false positives, and build dashboards measuring security posture, remediation progress, and KPIs.
• Automate vulnerability triage, ticket creation, and remediation workflows while supporting investigations, root cause analysis, and compliance activities.
• Partner with engineering teams, communicate risks and remediation progress, and promote security-by-design practices.

Requirements

• Undergraduate degree or equivalent relevant work experience.
• 2–4 years of experience in Application Security, DevSecOps, or a related security or software engineering role.
• Experience with SAST, SCA, secret scanning, and Infrastructure-as-Code scanning.
• Understanding of common software vulnerabilities, including the OWASP Top 10, CVEs, and software dependency risks.
• Experience supporting CI/CD pipelines such as GitHub Actions, GitLab CI, or Jenkins.
• Ability to communicate security risks clearly with technical and non-technical stakeholders.

Nice to have

• Experience with Wiz Code or similar platforms such as Snyk, Semgrep, Checkmarx, or Veracode.
• Experience with AWS, Azure, or Google Cloud Platform.
• Familiarity with Terraform or CloudFormation.
• Experience using Python, Bash, or similar scripting languages for automation.
• Knowledge of OWASP SAMM or NIST SSDF.
• Security certifications such as Security+, GWEB, CASE, or equivalent training.

Culture & Benefits

• Permanent full-time employment.
• Collaborative work with global development teams and technical and non-technical stakeholders.
• Hybrid working model with required office attendance at least two days per week.
• Resume must be submitted in English for consideration.