Secure Code Review Engineer Jobs

1 job found

Today

Senior Application Security Engineer

True Anomaly Denver, CO

Denver, CO

Today

$180k - $240k/yr Full time Senior Application Security Application Security Engineering

Apply Now

Job Description

True Anomaly builds mission-critical space systems and focuses on application-level security that supports government authorization and compliance. This onsite Senior Application Security Engineer role in Denver, CO offers strong benefits, an engineering-focused security culture, and a chance to improve security controls across cloud-native architectures.

What you’ll do

Create security architecture documentation and operational security guides used for government authorization processes.
Drive a vulnerability management program with remediation SLAs based on severity (30/90/180 days).
Conduct security code reviews across Elixir, Python, C++, and JavaScript codebases.
Partner with teams to triage and manage security automations using SAST (CodeQL, Semgrep), SCA (JFrog Xray), and DAST tools.
Collaborate with engineering teams to address security findings and strengthen secure coding practices.
Develop and deliver security training for software engineers and systems administrators.
Create and manage incident response playbooks tailored to application security events.
Evaluate and integrate third-party security solutions to enhance overall security capabilities.

What you bring

5+ years of experience in application security, product security, or security engineering.
Hands-on experience implementing security controls aligned to compliance frameworks such as NIST 800-171, NIST 800-53, FedRAMP, or CMMC.
Strong software engineering skills, with the ability to write production-quality code in at least one language: Python, Rust, Elixir, C++, or similar.
Experience with cloud security (Azure preferred, with AWS or GCP acceptable).
Knowledge of secure architecture principles, including threat modeling and risk assessment.
Knowledge of secure architecture patterns for authentication and authorization including OAuth2, JWT, RBAC, and ABAC.
Knowledge of cryptography and key management.
Understanding of defense-in-depth and Zero Trust principles.
Proven ability to collaborate with engineering teams to implement security controls without blocking velocity.
Eligible for DoD Secret or TS/SCI clearance.

Technologies you may work with

Compliance frameworks: NIST 800-171, NIST 800-53, FedRAMP, CMMC
Languages: Elixir, Python, C++, JavaScript, Rust
Cloud: Azure, AWS, GCP
Security: OAuth2, JWT, RBAC, ABAC, CodeQL, Semgrep, JFrog Xray, DAST, Zero Trust, threat modeling

Benefits

Best-in-class healthcare: 100% company-paid medical, dental, and vision coverage for you and your dependents, plus HSA/HRA options.
Flexible Time Off: for exempt employees, FTO plus accrued PTO up to 25 days for non-exempt employees, along with 12 paid holidays, plus Parental Leave and Sick Leave.
In-office perks: daily catered lunch and unlimited snacks for in-office employees.
401(k) and wellness: 401(k) retirement plan, fitness reimbursement, and Dog Fridays.
Equity participation: equity as part of the total compensation package.

Preferred skills

Active TS/SCI clearance or ability to obtain and maintain a security clearance.
Direct experience with NIST 800-171 Rev 3 or NIST 800-53 implementation projects (gap analysis, control implementation, evidence collection).
Experience with DoD Impact Levels (IL2/IL4/IL5/IL6) or STIGs.
Familiarity with Elixir/Erlang/Phoenix or other functional programming ecosystems (Scala, Haskell, F#, OCaml).
Experience with Azure Government Cloud or other FedRAMP-authorized cloud environments.
Experience using Ghommit.
Background in DevSecOps/Platform Security Engineering, including GitOps workflows and CI/CD security.
Background in DevSecOps/Platform Security Engineering, including Infrastructure as Code security (Terraform, Bicep, Pulumi).
Background in DevSecOps/Platform Security Engineering, including Kubernetes security (Pod Security Standards, network policies, service mesh).
Experience with security incident response, including detection engineering and SOAR integration.
Familiarity with aerospace, defense, or other highly regulated industries.
Previous experience in startups or fast-paced environments, including building processes from scratch.

Location and role details

Work location: Successful candidates must be located near Denver or Long Beach. Significant work must be done on site. #LI-Onsite.
Work environment: work environment details include factors such as temperature, noise level, inside or outside, or other factors that will affect working conditions.
Physical demands: job physical demands may include bending, sitting, lifting, and driving.

Citizenship and export/ITAR requirement

To conform to U.S. Government space technology export regulations, including the International Traffic in Arms Regulations (ITAR), you must be a U.S. citizen, lawful permanent resident of the U.S., protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State.

Compensation: USD 180,000 - 240,000 per year.

View full job page →

Get Secure Code Review Engineer Jobs alerts

New Secure Code Review Engineer Jobs, daily.