ATTENTION MILITARY AFFILIATED JOB SEEKERS - Our organization works with partner companies to source qualified talent for their open roles. The following position is available to Veterans, Transitioning Military, National Guard and Reserve Members, Military Spouses, Wounded Warriors, and their Caregivers. If you have the required skill set, education requirements, and experience, please click the submit button and follow the next steps. Unless specifically stated otherwise, this role is "On-Site"
AppSec Engineer
Minimum Clearance Required to Start: Secret
Percentage of Travel Required: Up to 10%
Type of Travel: Local The Opportunity:
Join a mission‑driven DoD program where your expertise in application security directly strengthens national defense. In this role, you will shape and elevate AppSec across a complex, modern application ecosystem—leading testing operations, influencing secure development practices, and mentoring the next generation of security engineers. You will work side‑by‑side with the Cybersecurity Architect to define secure SDLC strategy and ensure security is deeply woven into every phase of development, from initial design through final deployment.
REMOTE!
Responsibilities:
• Lead SAST operations using Fortify, including full ownership of findings triage and remediation tracking
• Oversee SonarQube continuous code security analysis and quality gate governance
• Manage and execute DAST testing and runtime vulnerability assessments
• Plan, lead, and deliver penetration testing engagements across varied application stacks
• Lead secure code reviews and coach developers on remediation techniques
• Own application vulnerability remediation tracking, verification, and closure
• Develop and maintain standards for AppSec assessments and penetration test reporting
• Drive secure development lifecycle (SDLC) compliance across assigned application portfolios
• Mentor junior and mid‑level AppSec engineers, fostering technical growth and excellence
• Serve as the AppSec liaison to the Cybersecurity Architect to advance program‑wide SDLC security strategy
Qualifications:
Required:
• Active Secret clearance
• 6–9 years of experience in application security, penetration testing, or secure software development
• Advanced proficiency with Fortify and SonarQube
• Demonstrated experience leading penetration testing engagements and performing secure code reviews
• Strong knowledge of web application, API, and mobile application vulnerabilities
• Proven ability to mentor and develop junior AppSec engineers
• DoD 8140.03M DCWF Intermediate Tier certification — one of: CEH(P), RCCE Level 1, Cloud+, CPTE, FITSP-A, GCED, GCIH, GCSA, GICSP, GSEC, PenTest+, or Security+
• Bachelor’s degree in Computer Science, Cybersecurity, Data Science, Information Systems, Information Technology, or Software Engineering
Desired:
• Multiple DoD 8140.03M DCWF Advanced Tier 541 certifications
• OSCP or equivalent offensive security certification
• Experience integrating security into DevSecOps pipelines
• Prior experience developing AppSec programs or secure coding standards within a DoD environment
• DoD 8140.03M DCWF Advanced Tier certification — one of: CFR, CISA, CISM, CySA+, GPEN, or GSNA
• Master’s or Ph.D. in Computer Science, Cybersecurity, Data Science, Information Systems, Information Technology, or Software Engineering
The proposed salary range for this position is:
$75,200-$158,100