Senior Application Security Engineering Lead

Responsibilities

• Perform application security analysis using both automated and manual techniques, including:
• Static code analysis (SAST)
• Software composition analysis (SCA)
• Fuzzing
• Manual code and design reviews
• Lead an application security team in support of multiple programs
• Identify, analyze, and help remediate application vulnerabilities
• Support software engineers in integrating security considerations into system and application designs
• Integrate and maintain application security tooling within CI/CD and DevSecOps pipelines
• Design, implement, and improve continuous integration security analysis tooling
• Tune and maintain security tools to reduce false positives and improve signal quality
• Assist development teams in understanding findings and implementing effective fixes
• Support threat modeling and secure design reviews
• Stay current with emerging vulnerabilities, attack techniques, and mitigation strategies
• Document findings, recommendations, and best practices
• Perform other duties as assigned

Requirements

• Bachelor’s degree plus 8+ years of professional experience in cybersecurity or software development, or equivalent experience
• 2+ years of experience focused on application/software security
• Experience analyzing source code for security flaws
• Familiarity with secure software development practices
• Strong analytical and problem-solving skills
• Detail-oriented with strong written and verbal communication abilities
• Ability to qualify for and maintain a DoD Secret security clearance
• Ability to meet DoD 8140.01 Cyberspace Workforce Management requirements within six months of hire
• Ability to effectively collaborate with government customer team members and other engineers

Candidates who have any of the following skills will be preferred:

• Active DoD Secret clearance or higher
• Experience identifying, exploiting, and remediating application vulnerabilities
• Credit for published CVEs is a strong plus
• Proficiency in one or more programming languages such as C++, Python, JavaScript, Rust
• Experience configuring and operating static analysis tools (e.g., Coverity, Klocwork, SonarQube)
• Experience configuring and operating software composition analysis tools (e.g., Snyk, Sonatype, Anchore, JFrog Xray)
• Experience with fuzzing frameworks (AFL, AFL++, honggfuzz, or similar)
• Experience with debugging, runtime instrumentation, or reverse engineering, including tools such as strace, eBPF, Ghidra or IDA Pro
• Familiarity with threat modeling methodologies and frameworks such as MITRE ATT&CK
• Experience working in DevSecOps or Agile development environments

*Resumes, Cover Letters, and Applications which are generated by AI will not be considered for employment. Colorado Residents: In any materials you submit, you may redact or remove age-identifying information such as age, date of birth, or dates of school attendance or graduation. You will not be penalized for redacting or removing this information.

Benefits

SciTec offers a highly competitive salary and benefits package, including:

• 4% Safe Harbor 401(k) match
• 100% company paid HSA Medical insurance, with a choice of 2 buy-up options
• 80% company paid Dental insurance
• 100% company paid Vision insurance
• 100% company paid Life insurance
• 100% company paid Long-term Disability insurance
• 100% company paid Hospital Indemnity insurance
• Voluntary Accident and Critical Illness insurance
• Short-term Disability insurance
• Annual Profit-Sharing Plan
• Discretionary Performance Bonus
• Paid Parental Leave
• Generous Paid Time Off, including Holiday, Vacation, and Sick Pay
• Flexible Work Hours

The pay range for this position is $155,000 - $185,000 / year. SciTec considers several factors when extending an offer of employment, including but not limited to the role and associated responsibilities, a candidate's work experience, education/training, and key skills. This is not a guarantee of compensation. SciTec is proud to be an Equal Opportunity employer. VET/Disabled.