Application Security Engineer

Acclaim Technical Services is seeking an experienced Application Security Engineer to embed security across the software development lifecycle for a cloud-native, centralized platform supporting end-to-end budget traceability. This onsite role is based in Reston, VA, with TS/SCI w/ Polygraph required for the Bethesda, MD area.

Location

• Reston, VA (onsite)

Salary

• USD 210,000 - 260,000 per year

Summary

The role focuses on integrating security into design, development, assessment, and release activities for mission applications, partnering with developers and cloud engineers to sustain secure operations. Work includes threat modeling, secure reviews, vulnerability remediation, and support for release authorization.

Responsibilities

• Integrate security throughout the software development lifecycle by partnering with developers and cloud engineers to design, build, assess, and sustain secure mission applications.
• Perform secure design and architecture reviews, threat modeling, secure code reviews, security testing, vulnerability remediation, and release authorization support.
• Develop or review applications using Python, JavaScript frameworks, SQL, Shell scripting, PL/SQL, and other programming languages, applying knowledge of common application vulnerabilities and secure coding practices.
• Carry out application security testing using SAST, DAST, SCA, secrets scanning, and container or infrastructure vulnerability scanning.
• Build and secure cloud-native applications and services using Kubernetes, containers, Docker, REST APIs, and CI/CD pipelines.
• Implement DevSecOps practices, including automated security controls and testing within build and deployment pipelines.
• Assess, prioritize, document, and communicate application and cloud security risks, findings, and remediation recommendations to technical and non-technical stakeholders.

Requirements

• Technical expertise and hands-on experience in application security, secure software development, software engineering, or DevSecOps, including the ability to apply skills to Oracle Cloud and customer mission challenges.
• Experience integrating security across the software development lifecycle, including secure design and architecture reviews, threat modeling, secure code review, security testing, vulnerability remediation, and release authorization support.
• Experience developing or reviewing applications using Python, JavaScript frameworks, SQL, Shell scripting, PL/SQL, and other programming languages with knowledge of common application vulnerabilities and secure coding practices.
• Experience with application security testing tools and processes, including SAST, DAST, SCA, secrets scanning, and container or infrastructure vulnerability scanning.
• Experience building and securing cloud-native applications and services using Kubernetes, containers, Docker, REST APIs, and CI/CD pipelines.
• Experience implementing DevSecOps practices, including automated security controls and testing within build and deployment pipelines.
• Experience with cloud-native security services and controls; Oracle Cloud Infrastructure (OCI) experience is desired.
• Knowledge of security frameworks and standards such as NIST RMF, NIST Secure Software Development Framework, OWASP, DISA STIGs, and applicable federal security requirements.
• Experience securing Oracle RDBMS environments, including database access controls, encryption, auditing, and secure handling of sensitive data.
• Ability to assess, prioritize, document, and communicate application and cloud security risks, findings, and remediation recommendations to technical and non-technical stakeholders.
• Passion for technology and willingness to continuously learn new security tools, techniques, and approaches for complex technical challenges.
• Experience working in an Agile framework.
• 8+ years of relevant experience in application security, software engineering, DevSecOps, cybersecurity, or related technical disciplines.
• Bachelor’s Degree in engineering, computer science, or a related technical discipline (Master’s degree preferred).

Desired Skills and Qualifications

• OCI IaaS and/or PaaS certifications are preferred.
• Security certifications such as CISSP, CSSLP, Security+, GIAC, CEH, OSCP, or comparable credentials.
• Experience implementing identity and access management, privileged access controls, secrets management, encryption, logging, monitoring, and incident response capabilities in cloud environments.
• Experience with AI technologies for software development and securing AI-enabled applications or development workflows.
• Data engineering experience, including securing data validations, business rules, data transformations, and sensitive-data handling.

Technologies

• Oracle Cloud, Oracle Cloud Infrastructure (OCI)
• Python, JavaScript frameworks, SQL, Shell scripting, PL/SQL
• Static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), secrets scanning
• Container vulnerability scanning, infrastructure vulnerability scanning
• Kubernetes, containers, Docker, REST APIs, CI/CD pipelines
• DevSecOps practices
• NIST RMF, NIST Secure Software Development Framework, OWASP, DISA STIGs
• Oracle RDBMS, encryption, auditing

Required Credentials and Experience

• 8+ years of relevant experience in application security, software engineering, DevSecOps, cybersecurity, or related technical discipline.
• Bachelor’s Degree in engineering, computer science, or a related technical discipline (Master’s degree preferred).