Senior Security Engineer

Senior Security Engineer will strengthen application security by embedding controls into the SDLC and CI/CD pipelines and improving proactive detection for web and APIs.

Responsibilities

• Develop and maintain software application security policies and procedures
• Implement software application security controls
• Partner with DevOps teams to develop and support a secure CI/CD pipeline
• Design and operate web application firewall (WAF) and API protections, including rule tuning, false-positive reduction, and automated policy updates
• Identify application security vulnerabilities and issues, perform risk assessments, and provide mitigations
• Develop security monitoring for the application stack
• Conduct technical investigations of application security incidents
• Interface with senior stakeholders across the IT leadership team to interpret risks and priorities proactively
• Support the OF diversity and inclusion strategy by following policies and procedures that ensure opportunities for employees and diverse business partners
• Assist with other job duties as assigned

Requirements

• 6 to 8 years of experience in Application Security (designing, implementing, and operating security controls in enterprise application environments)
• Hands-on experience with web application security, including OWASP Top 10 vulnerabilities
• Hands-on experience with WAF/API security (policy design, rule tuning, automation)
• Hands-on experience with container security, including runtime hardening, image scanning, and vulnerability risk assessments
• Hands-on experience conducting web application security scans, vulnerability assessments, and/or penetration testing
• Experience investigating problems and processes using established methodologies and best practices
• Experience working with Authentication and Authorization services such as OAuth and OpenID
• Experience operating on-prem or cloud-based security platforms
• Ability to troubleshoot security and network-related issues and communicate technical findings effectively
• Ability to listen and integrate ideas from diverse individuals, build respectful relationships, collaborate, and resolve conflicts constructively
• Bachelor’s Degree in Information Security or Computer Science or Computer/Electrical Engineering, or equivalent field experience
• Proof of eligibility to work in the United States

Skills and Technologies

• OWASP Top 10
• Web application firewall (WAF)
• OAuth
• OpenID

Position Summary

• Designs, implements, operates, and continuously improves OF security technologies and controls across applications and supporting platforms
• Primary focus on Application Security by embedding security into the SDLC and CI/CD pipelines
• Strengthens web and API protections and supports proactive detection
• Contributes broadly to Security Engineering capabilities including identity, security platforms (cloud/on-prem), logging/telemetry, and automation
• Partners with development, DevOps, and operations teams to build secure-by-default applications and services

Location and Compensation

• Location: Reston, VA (onsite)
• Salary: USD 140,441 to 202,303 per year

Core Values

• Integrity: accountability, consistency, transparency, and trust
• Agility: adaptability, continuous improvement, expertise, and flexibility
• Partnership: collaboration, communication, leadership, and teamwork
• Inclusivity: diversity, relationships, respect, and support