Application Security Tooling Engineer

The Application Security Tooling Engineer will design, operate, and continuously improve an AppSec scanning ecosystem across the software development life cycle, supporting defense-focused security needs in regulated environments at Monterey, CA (onsite).

Responsibilities

• Design, operate, and continuously improve the defense agency's application security (AppSec) scanning ecosystem across the SDLC.
• Run and integrate software composition analysis (SCA) with Sonatype, static application security testing (SAST) with Fortify, container and Kubernetes security with Red Hat Advanced Cluster Security (StackRox), and dynamic application security testing (DAST) with Burp Suite to deliver scalable, auditable, mission-ready controls in regulated environments.
• Deploy, configure, harden, and maintain Sonatype, Fortify, StackRox, and Burp in on-prem and/or accredited cloud environments.
• Manage upgrades, plugins, licensing, capacity planning, backup and restore, high availability, and disaster recovery.
• Establish SLAs/SLOs, monitoring and alerting practices, and operational runbooks.
• Integrate application security tools into CI/CD pipelines (for example, Jenkins and GitLab CI) using policy-based gating and risk-based exceptions.
• Standardize developer secure-by-default workflows using pull request checks, nightly scans, and release readiness criteria.
• Build reusable templates and reference implementations for product teams.
• Define and tune scanning policies, including severity thresholds, exploitability context, allowlists and denylists, and quality gates aligned to agency standards.
• Reduce false positives and false negatives through rule tuning, calibration, and developer feedback loops.
• Maintain an auditable vulnerability management workflow covering triage, ownership, remediation SLAs, and exception or waiver documentation.
• Provide actionable findings with clear reproduction steps and secure coding guidance.
• Partner with engineering teams to remediate issues in code, dependencies, container images, and Kubernetes configurations.
• Coordinate retesting and verify fixes, including targeted Burp validation for high-risk applications and APIs.
• Implement image scanning, runtime detections, admission controls, and Kubernetes policy enforcement.
• Integrate with registries and orchestration platforms; maintain cluster baselines and least-privilege controls.
• Operationalize incident-ready detections and response playbooks with SOC and IR teams.
• Produce metrics and dashboards such as vulnerability trends, time-to-remediate, pipeline pass rates, and policy exceptions.
• Support RMF/ATO evidence needs with scan outputs, control mappings, and procedures.
• Provide support for Agile project management, with hands-on Jira experience strongly preferred.
• Manage a team of at least one other AppSec professional.

Requirements

• Active Secret clearance required.
• 5+ years of experience in application security engineering and/or DevSecOps in regulated environments.
• Hands-on administration and pipeline integration experience with Sonatype (Nexus IQ/Lifecycle), Fortify (SCA/SSC), StackRox/Red Hat ACS, and Burp Suite (Professional/Enterprise preferred).
• Strong CI/CD and automation skills, with the ability to implement repeatable integrations and policy gates.
• Working knowledge of Secure SDLC, OWASP Top 10, dependency risk, and SBOM concepts, plus container and Kubernetes security.
• Working knowledge of Linux administration, networking fundamentals, TLS/certificate management, and identity integration (SSO/LDAP).
• Working knowledge of common languages and build systems, including Java/Maven/Gradle, .NET/NuGet, Node/npm, and Python/pip.
• Working knowledge of Oracle Cloud Infrastructure.
• DoD/IC experience with RMF, STIGs, and vulnerability management processes.

Technologies

• Sonatype (Nexus IQ/Lifecycle), Fortify (SCA/SSC), StackRox (Red Hat Advanced Cluster Security / Red Hat ACS), Burp Suite (Professional/Enterprise)
• Oracle Cloud Infrastructure, Jenkins, GitLab CI, Jira
• OWASP Top 10, SBOM concepts
• Linux, TLS, SSO, LDAP
• Java, Maven, Gradle, .NET, NuGet, Node, npm, Python, pip
• Harbor, Artifactory, ECR, Kubernetes, OpenShift, Helm
• Splunk, ServiceNow, SIEM, SOAR
• RMF, ATO, STIGs

Preferred Qualifications

• Familiarity with registries and orchestration: Harbor/Artifactory/ECR, Kubernetes/OpenShift, and Helm.
• Experience integrating with SIEM/SOAR and ticketing tools (for example, Splunk, ServiceNow, and Jira).
• Relevant certifications (one or more): Security+, CISSP, CSSLP, GIAC, or Kubernetes security certifications.