Application Security Engineer

Job Summary

To enhance the defense agency's application security ecosystem, the remote Application Security Tooling Administrator will design, operate, and improve security scanning tools such as Sonatype, Fortify, StackRox, and Burp Suite while integrating them into CI/CD pipelines and ensuring compliance with agency standards.

Key Responsibilities:

• Deploy, configure, and maintain application security tools in on-prem and cloud environments, managing upgrades and operational runbooks
• Integrate security tools into CI/CD pipelines, standardizing secure workflows and building reusable templates for product teams
• Define and tune scanning policies, maintain a vulnerability management workflow, and provide actionable findings for remediation efforts

Required Qualifications:

• DoD 8570 IAT II certification (e.g., Security+)
• Active Secret clearance
• 3+ years of experience in application security engineering and/or DevSecOps in regulated environments
• Hands-on experience with Sonatype, Fortify, StackRox, and Burp Suite
• Strong skills in CI/CD automation and secure SDLC practices