Application Security Engineer

About This Role

This engineering role involves embedding security directly into the software development lifecycle for applications supporting a critical DoD mission. The engineer will partner with developers and architects and use industry-leading tools to identify, validate, and remediate vulnerabilities across a diverse application ecosystem.

Responsibilities

• Embed robust security practices into the secure SDLC from design through deployment
• Execute both static (SAST) and dynamic (DAST) application security testing using enterprise tooling
• Lead and support penetration testing engagements, guiding developers through actionable remediation
• Work within a fully staffed cybersecurity program, including architecture, GRC, and operations experts
• Grow expertise across the AppSec spectrum: code review, runtime testing, and compliance validation
• Perform SAST using Fortify across assigned applications
• Conduct continuous code quality and security analysis using SonarQube
• Execute DAST to identify runtime vulnerabilities
• Coordinate and execute penetration testing engagements
• Conduct secure code reviews and document findings with actionable guidance
• Track and verify vulnerability remediation through closure
• Validate application security controls against program and DoD requirements
• Author application security assessment and penetration test reports
• Support the Cybersecurity Architect with secure SDLC process design

Requirements

• Active Secret or TS clearance
• 3–5 years of experience in application security, secure development, or penetration testing
• Hands-on experience with SAST platforms (Fortify preferred)
• Working knowledge of OWASP Top 10 and common application vulnerability classes
• Demonstrated experience conducting or supporting penetration tests
• DoD 8140.03M DCWF Basic Tier — CEH
• DoD 8140 Interim Education Options

Nice to have:

• DoD 8140.03M DCWF Intermediate Tier — one of: CEH(P), RCCE Level 1, Cloud+, CPTE, FITSP-A, GCED, GCIH, GCSA, GICSP, GSEC, PenTest+, or Security+
• Bachelor’s degree in Computer Science, Cybersecurity, Data Science, Information Systems, IT, or Software Engineering
• Experience with SonarQube or similar secure code analysis platforms
• Familiarity with DevSecOps pipelines and CI/CD security integration
• Scripting or development experience in Python, Java, or similar languages

Benefits

• Healthcare
• Wellness
• Financial
• Retirement