Application Security Engineer
Application Security
Application Security Engineering
Aws Solutions Architect
Cloud Platforms
Data Security
Dynamic Application Security Testing
Facilities Management
Information Security
InfoSec
Management
Pki/tls
Product Security
Project Management
Risk Governance
Risk Management
Security
Security Assurance
Security Automation
Security Compliance
Security Operations
Security Remediation
Security Standards
Security Testing
Security Testing Tools
Software Security
Vulnerability Management
Web Security
Job Description
Steampunk is looking for an Application Security Engineer to support security hardening across enterprise web applications and environments. The role focuses on remediating persistent, portfolio-wide application vulnerabilities while improving vulnerability management through proactive solutions, process improvements, and automation.
This position is based in McLean, VA 22102 (onsite) and supports cross-functional work with system administration, development, security assurance, and the SOC to ensure findings are understood, remediated, and baselined appropriately.
Responsibilities
- Serve as technical subject matter expertise for risk assessments while working in an Agile environment with an understanding of the full software development lifecycle.
- Ensure application development portfolios receive and implement appropriate security practices.
- Collaborate with application development and security assurance teams so vulnerability findings are properly interpreted and addressed through remediation or baselining.
- Document and socialize security findings and remediation solutions in an enterprise knowledge base.
- Support the Information Assurance Branch and the SOC with scan analysis, and partner with development teams to resolve security findings.
Requirements
- U.S. government Security Clearance: Ability to obtain and maintain eligibility.
- At least one professional certification relevant to the technical service provided, and maintain a certification relevant to the product being deployed and/or maintained.
- Education: Master's Degree.
- Experience: At least 3 years of relevant experience.
Technologies
- Security and protocols: PKI/TLS
- Build and engineering: Maven, Grade, GIT, Jenkins, Ansible
- Application and platforms: Java, C#/.NET, Apache Tomcat, Apache HTTP Server, IIS, F5
- Databases: Oracle, MSSQL, PostGres
- Cloud: AWS, Azure GovClouds
- Compliance and tracking: DISA STIG, JIRA, Service Now
- Security testing and scanning: Invicti, Web Inspect, DAST/IAST suites
- Scripting and automation: Python
Preferred Qualifications
- Former developer or systems administrator experience.
- Working knowledge of enterprise application build and deployment technologies including Maven, Grade, GIT, Jenkins, Ansible, Java, C#/.NET, Apache Tomcat, Apache HTTP Server, IIS, F5, Oracle, MSSQL, and PostGres.
- Working knowledge and experience in AWS and Azure GovClouds.
- Ability to analyze DISA STIG audit compliance scan results and provide recommendations for resolution.
- Ability to analyze security environments and provide recommendations.
- Working knowledge of JIRA, Service Now, or equivalent tools.
- Working knowledge of operating system and dynamic application security testing scan tools such as Invicti, Web Inspect, and DAST/IAST suites.
- Experience using Python to automate tasks.
Certifications
- CEH, GFACT, GPEN, OSCP, or other relevant industry certifications.
- Other application-based technology-specific certifications.
Compensation: $100,000 - $155,000 per year.
Similar Jobs
