Application Security Engineer

Description

The company is a technology firm serving US federal agencies across defense, national security, public safety, civilian, and military health work, with more than 13,000 people.

The team is looking for a senior application security engineer to work with development teams on secure, scalable software delivery.

This role leads the AppSec scrum team, builds security into the development lifecycle, and designs processes that help developers work securely without losing speed.

The role calls for hands-on engineering experience and a solid grasp of current application security practice.

Responsibilities

• Run the AppSec scrum team, including all agile ceremonies.
• Set the priorities for the security backlog and coach teammates on best practices.
• Connect security, development, and operations teams so they work together.
• Apply AI tools to make team workflows more efficient.
• Test web and AI applications for security vulnerabilities and triage what you find.
• Give clear, practical remediation guidance.
• Design and maintain secure CI/CD pipelines in GitLab and Jenkins.
• Build hardened build processes and secure supply chain practices, including SBOM management.
• Lead shift-left threat modeling and work with engineers to handle risks early.
• Make sure AI agents and pipelines follow secure design principles.
• Bring security tools (Snyk, Nexus, JFrog) into developer workflows.
• Manage dependency lifecycles and make sure artifacts are verified and signed.
• Weigh security needs against delivery speed in a federal setting.
• Work through technical and organizational gray areas.

Requirements

• 6+ years in software engineering and application or infrastructure security, including hands-on production coding.
• Proven experience securing CI/CD pipelines.
• Working knowledge of one or more build systems such as Gradle, Maven, or Docker/Kubernetes.
• Experience with SBOM formats CycloneDX and SPDX.
• Strong grasp of AppSec principles, SSDF, threat modeling, and secrets management.
• Nice to have: experience with artifact signing using Sigstore or Cosign.
• US citizen.
• Eligible to obtain a Public Trust clearance.

Conditions

Pay range for California, Colorado, Connecticut, Hawaii, Illinois, Maine, Maryland, Massachusetts, Minnesota, New Jersey, New York, Ohio, Vermont, Virginia, Washington, and the District of Columbia: $109,500 - $224,200 USD base pay.

Final pay depends on factors such as location, role, skills, and experience.

Applications are accepted on an ongoing basis with no fixed deadline.

Equal opportunity is a core commitment, and every employee shares responsibility for an inclusive culture.

Benefits

• A wide range of benefits is offered, with details available on the company's benefits page.
• Support for growth through hands-on experience, certifications, and industry training.