Staff Application Security Engineer

True Anomaly is hiring a Staff Application Security Engineer to help secure mission-critical space systems and support stringent government authorization requirements. In this onsite role based in Denver, CO, you will build and audit application-level security controls across cloud-native architectures, with an emphasis on audit logging, incident response readiness, access control, security monitoring, vulnerability management, and secure software development.

What you’ll do

• Create security architecture documentation and operational security guides used for government authorization processes
• Lead a vulnerability management program with defined remediation SLAs based on severity (30/90/180 days)
• Conduct security code reviews across Elixir, Python, C++, and JavaScript codebases
• Partner with engineering teams to triage and manage security automations using SAST (CodeQL, Semgrep), SCA (JFrog Xray), and DAST tools
• Support remediation of security findings and help teams adopt secure coding practices
• Develop and deliver security training for software engineers and systems administrators
• Produce and manage application-security incident response playbooks
• Evaluate and integrate third-party security solutions to strengthen overall security capabilities

Requirements

• 10+ years of experience in application security, product security, or security engineering
• Hands-on experience implementing security controls aligned with compliance frameworks including NIST 800-171, NIST 800-53, FedRAMP, or CMMC
• Strong software engineering background with production-quality coding ability in at least one of: Python, Rust, Elixir, C++, or similar
• Cloud security experience (Azure preferred; AWS or GCP acceptable)
• Solid understanding of secure architecture, including threat modeling and risk assessment
• Strong understanding of authentication and authorization patterns including OAuth2, JWT, RBAC, and ABAC
• Solid understanding of cryptography and key management
• Knowledge of defense-in-depth and Zero Trust principles
• Demonstrated ability to collaborate with engineering teams to implement security controls while maintaining delivery velocity
• Eligibility for DoD Secret or TS/SCI clearance

Technologies

• Elixir, Python, C++, JavaScript, Rust
• OAuth2, JWT, RBAC, ABAC
• Azure, AWS, GCP
• NIST 800-171, NIST 800-53, FedRAMP, CMMC
• SAST: CodeQL, Semgrep
• SCA: JFrog Xray
• DAST, Zero Trust
• Cryptography

Benefits

• 100% company-paid medical, dental, and vision coverage for you and your dependents, with HSA/HRA options
• Flexible Time Off (FTO) for exempt employees; accrued PTO up to 25 days for non-exempt employees; plus 12 paid holidays
• Parental Leave
• Sick Leave
• Daily catered lunch and unlimited snacks for in-office employees
• 401(k) retirement plan
• Fitness reimbursement
• Dog Fridays
• Equity participation as part of the total compensation package

Preferred skills

• Active TS/SCI clearance or ability to obtain and maintain a security clearance
• Direct experience with NIST 800-171 Rev 3 or NIST 800-53 implementation projects, including gap analysis, control implementation, and evidence collection
• Experience with Department of Defense Impact Levels (IL2/IL4/IL5/IL6) or STIGs
• Familiarity with Elixir/Erlang/Phoenix or other functional programming ecosystems (Scala, Haskell, F#, OCaml)
• Experience with Azure Government Cloud or other FedRAMP-authorized cloud environments
• Experience using Ghommit tool
• Background in DevSecOps or Platform Security Engineering, including GitOps workflows and CI/CD security; Infrastructure as Code security (Terraform, Bicep, Pulumi); Kubernetes security (Pod Security Standards, network policies, service mesh)
• Experience with security incident response including detection engineering and SOAR integration
• Background in aerospace, defense, or other highly regulated industries (finance, healthcare, critical infrastructure)
• Experience in startups or fast-paced environments building processes from scratch

Location and eligibility

• Denver, CO onsite (significant work on site); candidates must be located near Denver or Long Beach (LI-Onsite)
• U.S. citizenship or eligibility to obtain required authorizations is required to comply with U.S. Government space technology export regulations, including ITAR

Compensation: USD 200,000 - 290,000 per year. Experience: 10+ years.