Senior Application Security Engineer

True Anomaly builds mission-critical space systems and focuses on application-level security that supports government authorization and compliance. This onsite Senior Application Security Engineer role in Denver, CO offers strong benefits, an engineering-focused security culture, and a chance to improve security controls across cloud-native architectures.

What you’ll do

• Create security architecture documentation and operational security guides used for government authorization processes.
• Drive a vulnerability management program with remediation SLAs based on severity (30/90/180 days).
• Conduct security code reviews across Elixir, Python, C++, and JavaScript codebases.
• Partner with teams to triage and manage security automations using SAST (CodeQL, Semgrep), SCA (JFrog Xray), and DAST tools.
• Collaborate with engineering teams to address security findings and strengthen secure coding practices.
• Develop and deliver security training for software engineers and systems administrators.
• Create and manage incident response playbooks tailored to application security events.
• Evaluate and integrate third-party security solutions to enhance overall security capabilities.

What you bring

• 5+ years of experience in application security, product security, or security engineering.
• Hands-on experience implementing security controls aligned to compliance frameworks such as NIST 800-171, NIST 800-53, FedRAMP, or CMMC.
• Strong software engineering skills, with the ability to write production-quality code in at least one language: Python, Rust, Elixir, C++, or similar.
• Experience with cloud security (Azure preferred, with AWS or GCP acceptable).
• Knowledge of secure architecture principles, including threat modeling and risk assessment.
• Knowledge of secure architecture patterns for authentication and authorization including OAuth2, JWT, RBAC, and ABAC.
• Knowledge of cryptography and key management.
• Understanding of defense-in-depth and Zero Trust principles.
• Proven ability to collaborate with engineering teams to implement security controls without blocking velocity.
• Eligible for DoD Secret or TS/SCI clearance.

Technologies you may work with

• Compliance frameworks: NIST 800-171, NIST 800-53, FedRAMP, CMMC
• Languages: Elixir, Python, C++, JavaScript, Rust
• Cloud: Azure, AWS, GCP
• Security: OAuth2, JWT, RBAC, ABAC, CodeQL, Semgrep, JFrog Xray, DAST, Zero Trust, threat modeling

Benefits

• Best-in-class healthcare: 100% company-paid medical, dental, and vision coverage for you and your dependents, plus HSA/HRA options.
• Flexible Time Off: for exempt employees, FTO plus accrued PTO up to 25 days for non-exempt employees, along with 12 paid holidays, plus Parental Leave and Sick Leave.
• In-office perks: daily catered lunch and unlimited snacks for in-office employees.
• 401(k) and wellness: 401(k) retirement plan, fitness reimbursement, and Dog Fridays.
• Equity participation: equity as part of the total compensation package.

Preferred skills

• Active TS/SCI clearance or ability to obtain and maintain a security clearance.
• Direct experience with NIST 800-171 Rev 3 or NIST 800-53 implementation projects (gap analysis, control implementation, evidence collection).
• Experience with DoD Impact Levels (IL2/IL4/IL5/IL6) or STIGs.
• Familiarity with Elixir/Erlang/Phoenix or other functional programming ecosystems (Scala, Haskell, F#, OCaml).
• Experience with Azure Government Cloud or other FedRAMP-authorized cloud environments.
• Experience using Ghommit.
• Background in DevSecOps/Platform Security Engineering, including GitOps workflows and CI/CD security.
• Background in DevSecOps/Platform Security Engineering, including Infrastructure as Code security (Terraform, Bicep, Pulumi).
• Background in DevSecOps/Platform Security Engineering, including Kubernetes security (Pod Security Standards, network policies, service mesh).
• Experience with security incident response, including detection engineering and SOAR integration.
• Familiarity with aerospace, defense, or other highly regulated industries.
• Previous experience in startups or fast-paced environments, including building processes from scratch.

Location and role details

• Work location: Successful candidates must be located near Denver or Long Beach. Significant work must be done on site. #LI-Onsite.
• Work environment: work environment details include factors such as temperature, noise level, inside or outside, or other factors that will affect working conditions.
• Physical demands: job physical demands may include bending, sitting, lifting, and driving.

Citizenship and export/ITAR requirement

To conform to U.S. Government space technology export regulations, including the International Traffic in Arms Regulations (ITAR), you must be a U.S. citizen, lawful permanent resident of the U.S., protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State.

Compensation: USD 180,000 - 240,000 per year.