Application Security Engineer

Application Security Engineer role at Leidos in Omaha, Nebraska, focused on risk-based application security adjudication and strengthening software supply chain security.

Responsibilities

• Independently evaluate software dependencies, assess risk, and approve or reject components
• Document defensible technical decisions tied to dependency and component risk determinations
• Improve software supply chain security using SBOMs, transitive dependencies, component provenance, vulnerability intelligence, and artifact integrity
• Assess vulnerabilities based on real application use and operational context, not only automated scan output or CVSS scores
• Partner with software engineers and DevSecOps teams to resolve security findings while minimizing impact to development velocity
• Use Jira, Confluence, Nexus, Git, development operations practices, collaboration, and source control tools
• Support creation and updates of documentation and specifications for design, development, and testing

Requirements

• Citizenship and clearance: US Citizen; ability to obtain and maintain a TS/SCI within 365 days of start date with Leidos
• Education and experience: Bachelor’s degree with 4+ years of experience, or Master’s degree with 2+ years; additional experience may be considered in lieu of a degree
• Experience performing application security assessments, vulnerability analysis, and security risk evaluations across enterprise software applications and development environments
• Experience evaluating and adjudicating third-party libraries and external dependencies for security vulnerabilities, licensing concerns, and supply chain risk
• Working knowledge of SCA, SAST, and DAST methodologies and tools
• Experience analyzing CVEs, CVSS scores, and vulnerability intelligence to determine applicability, exploitability, and operational risk
• Understanding of SSDLC practices, secure coding principles, and application security best practices
• Familiarity with software supply chain security concepts such as dependency management, SBOMs, artifact integrity, and vulnerability remediation
• Experience collaborating with development teams to identify, prioritize, document, and remediate application security findings
• Working knowledge of common application security risks and vulnerabilities, including OWASP Top 10 and CWE classifications
• Ability to develop technical security assessments, write risk-based adjudication decisions, and communicate findings and recommendations to technical and program stakeholders

Technologies

• JavaScript
• Jira, Confluence, Nexus, Git
• SBOMs
• Software Composition Analysis (SCA)
• Static Application Security Testing (SAST)
• Dynamic Application Security Testing (DAST)
• CVEs, CVSS
• OWASP Top 10, CWE classifications
• SSDLC

Preferred Qualifications

• US Citizen with an active TS/SCI
• Experience supporting application security activities within DoD, Intelligence Community, or other highly regulated software development environments
• Experience with modern software development (Java, Python, Javascript, Rust, etc.)
• Experience implementing or managing third-party library approval and adjudication processes, including provenance, known vulnerabilities, transitive dependencies, licensing restrictions, and mitigation strategies
• Hands-on experience with SCA and vulnerability management tools (Sonatype Nexus IQ, JFrog Xray, Black Duck, Snyk, Mend, Dependency-Track, or equivalent)
• Experience with application security testing tools (Fortify, Checkmarx, Veracode, Semgrep, SonarQube, or equivalent)
• Experience generating, analyzing, and maintaining SBOMs using CycloneDX and SPDX
• Familiarity with software supply chain security frameworks and guidance, including NIST SP 800-218 (SSDF), NIST SP 800-53, NIST SP 800-161, and relevant CISA guidance
• Experience assessing vulnerability exploitability and prioritizing remediation using VEX, CISA KEV, EPSS, and other threat intelligence sources
• Experience integrating automated security scanning, dependency analysis, and compliance checks into CI/CD and DevSecOps workflows
• Experience securing containerized applications, container images, and Kubernetes-based deployment environments
• Understanding of artifact repositories, package managers, and dependency ecosystems (Maven, Gradle, npm, NuGet, PyPI, Cargo)
• Experience evaluating component provenance, artifact signing, integrity verification, and build-pipeline security (Sigstore, SLSA, or equivalent)
• Ability to evaluate findings in the context of architecture, runtime behavior, and operational exposure to distinguish exploitable risks from false positives or non-applicable results
• Experience developing security policies, risk acceptance criteria, vulnerability exception processes, and documented mitigation strategies
• Experience with RMF, ATO processes, and security control assessment activities
• Experience scripting or automating security analysis workflows using Python, PowerShell, Bash, or similar technologies
• Familiarity with secure development practices for Java, C/C++, Rust, JavaScript, or other enterprise languages
• Relevant cybersecurity certifications such as CISSP, CSSLP, Security+, or GIAC GWEB
• Experience with USSTRATCOM Nuclear Planning process

Location and Work Model

• Omaha, NE
• Onsite
• Some remote/work-from-home possible

Pay Range

• USD 87,100 to USD 157,450 per year