agency-application-security-engineer

Use parameterized queries or an ORM query builder instead of string concatenation, so user input is treated as data rather than executable SQL. Combine this with input length validation and schema validation libraries like Zod at every trust boundary.

Map the system's data flows, assets, and trust boundaries first, then analyze each component against the six STRIDE categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Every identified threat must produce a specific, testable security requirement.

SAST analyzes source code statically in CI pipelines to catch vulnerabilities before deployment, while DAST tests the running application in staging environments to find runtime issues. Neither catches everything, so both should be combined with manual review of authorization and business logic.

Tune scanning rules to your codebase, suppress validated non-exploitable findings with documented justification, and set severity thresholds so only actionable results block merges. Keeping false positives below 20 percent maintains developer trust in the tooling.

Critical and High severity vulnerabilities with an available fix should block the pipeline, while Critical findings without a fix should trigger tracked warnings. Remediation SLAs are typically 7 days for Critical, 30 days for High, and 90 days for Medium severity.