Application Security Engineer – Software Vulnerability Remediation

Application Security Engineer role supporting a mission-critical application modernization program for a Department of War customer. The position focuses on vulnerability identification and remediation, evidence support for continuous monitoring, and collaboration with software teams to strengthen secure coding practices.

Responsibilities

• Identify and remediate security findings across existing production applications, including dependency vulnerabilities, container vulnerabilities, STIG compliance issues, and code-level findings from security scans and assessments.
• Maintain accurate and current Plans of Action and Milestones (POA&Ms) for the application portfolio, tracking security findings and remediation progress.
• Collaborate with the Information System Security Engineer (ISSE) to develop and maintain application security evidence for continuous monitoring requirements.
• Partner with software development squads to implement secure coding fixes and address vulnerabilities within application codebases.
• Support ongoing application security improvements while ensuring the continued operation and sustainment of production applications.

Required Qualifications

• 4+ years of experience in application security, secure software engineering, or a closely related discipline.
• Hands-on experience identifying and remediating security vulnerabilities in Java or Go (Golang) applications.
• Experience addressing security findings within production software environments.

Technologies

• Java
• Go (Golang)
• Syft
• Grype

Preferred Qualifications

• Experience using software vulnerability scanning tools such as Syft, Grype, or similar technologies.
• Familiarity with Security Technical Implementation Guides (STIGs).
• Active Secret security clearance.

Benefits

• Health insurance
• Dental insurance
• Vision insurance
• Life insurance
• Comprehensive 401(k) plan with matching and immediate vesting

Work Location and Schedule

• Location: Hybrid. Reston, VA headquarters and approved remote locations within the United States, with on-site work at Government facilities in Northern Virginia and Maryland as required.
• Equipment: Government-furnished equipment is used for all access to Government environments.
• Schedule: Full-time, 40 hours per week, Monday through Friday, with core hours of 9:00 a.m. to 3:00 p.m. Eastern.
• Delivery cadence: Work is organized into two-week sprints, with a customer demonstration each sprint.
• Travel: 0–10%, within the Washington, DC metropolitan area.

Security and Eligibility

• U.S. citizenship required. Must be eligible to obtain and maintain a DoW security clearance.
• An active Secret clearance or higher is strongly preferred and may allow an earlier start.
• This position is contingent upon contract award, with an anticipated start in October 2026.

Compensation

USD 130,000–150,000 per year, depending on experience.