Secure Software Development Lifecycle

Secure Software Development Lifecycle Engineer Jobs

3 jobs found

13d ago

Cybersecurity Engineer (Embedded Systems)

Arete Technologies Melbourne, FL

Melbourne, FL

13d ago

$63 - $70/hr Full time Application Security Embedded Systems Security Information Security

Apply Now

Job Description

Arete Technologies is seeking a Software Cybersecurity Engineer (Embedded Systems) to support cybersecurity for Trip Optimizer® and LOCOTROL throughout the product development lifecycle.

Responsibilities

Support cybersecurity activities across the SSDLC (software development lifecycle)
Maintain cybersecurity documentation, including CATO evidence packages
Conduct and track vulnerability assessments, security scans, and remediation efforts
Review software architectures, designs, and requirements for security risks
Assist with threat modeling, risk assessments, and security impact analysis
Track security findings and coordinate with engineering teams through resolution
Support cybersecurity compliance activities, including audits and readiness assessments
Create cybersecurity metrics, dashboards, and status reporting
Provide guidance on secure C++ coding and vulnerability remediation
Integrate cybersecurity requirements into product development processes

Requirements

Bachelor’s degree in Cybersecurity, Information Security, Computer Science, Software Engineering, Computer Engineering, or related technical field
Experience supporting cybersecurity in software, embedded systems, or industrial environments
Experience using security scanning and analysis tools
Understanding of cybersecurity frameworks and standards
Strong technical documentation and communication skills
Ability to work independently and collaborate with cross-functional engineering teams
Knowledge of vulnerability management, threat modeling, risk assessment, SSDLC, and security compliance/governance

Technologies

Trip Optimizer®
LOCOTROL
CATO evidence packages
Secure C++ coding, C++
Polaris
Black Duck
Coverity
SAST, DAST, SCA
RTOS, QNX Neutrino
DevSecOps, CI/CD
GitLab, Jenkins
IBM ELM Tool Suite
IEC 62443
NIST CSF, NIST 800-53

Preferred Skills

Experience with Polaris, Black Duck, Coverity, SAST, DAST, or SCA tooling
Embedded C++ / RTOS / QNX Neutrino experience
DevSecOps and CI/CD security integration with GitLab and Jenkins
IBM ELM Tool Suite experience
Security certifications such as Security+, CISSP, GSEC, or SSCP
Experience in rail, transportation, industrial automation, or safety-critical environments
Knowledge of IEC 62443, NIST CSF, and NIST 800-53

Benefits

Dental insurance
Health insurance
Vision insurance

Work Location

Onsite: W Melbourne, FL

Pay

USD 63.00 - 70.00 per hour

View full job page →

20d ago

Principal Product Security Engineer

Navy Federal Credit Union Winchester, VA

Winchester, VA

20d ago

Full time Senior Application Security Application Security Engineering

Apply Now

Job Description

Navy Federal Credit Union is looking for a senior, individual contributor Principal Product Security Engineer to shape how secure software is delivered across the organization. In this onsite role in Winchester, VA, you will define and integrate Secure Software Development Lifecycle (Secure SDLC) practices into Navy Federal’s software delivery workflows, serving as an integration lead between product security expectations and engineering execution.

This position is designed for a partner who can translate security standards and risk expectations into practical engineering requirements, support governance and lifecycle risk decision points, and drive adoption measures that improve developer experience and product security outcomes at scale.

Summary

Principal Product Security Engineer - Secure Development Lifecycle is a senior individual contributor role that defines and integrates Secure SDLC practices into software delivery workflows.
Acts as an integration lead, aligning product security expectations with engineering and technology processes, governance forums, and lifecycle risk decision points.

Responsibilities

Define and mature Secure Software Development Lifecycle practices aligned to Navy Federal software delivery processes, operating models, and secure development practices.
Define and support a pre-production product security scorecard for risk-informed release decisions, communicating product security posture, open risks, exceptions, and required remediation actions to business and technology stakeholders.
Serve as the senior individual contributor integration lead for embedding Secure Development Practice capabilities into engineering workflows, governance forums, and lifecycle activities.
Map product security activities to software delivery processes including intake, planning, architecture review, design, development, testing, release, exception management, and operational handoff.
Establish repeatable process patterns to integrate threat modeling, secure coding, application security testing, software composition analysis, API security, software supply chain security, product integrity testing, and risk-based exception handling.
Identify and reduce redundant reviews, unclear handoffs, late-stage security friction, and legacy process steps that do not align with Navy Federal software delivery practices.
Develop Secure SDLC operating models, workflow diagrams, playbooks, process documentation, RACI models, control integration points, and implementation guidance.
Translate security standards, objectives, and risk expectations into practical engineering requirements and developer-consumable guidance.
Partner with software engineering, architecture, DevSecOps, Information Security, governance, and risk stakeholders to align secure development practices with enterprise delivery processes.
Support integration of secure development expectations into architecture governance, delivery boards, exception processes, and lifecycle risk decision points.
Recommend process improvements that strengthen security outcomes, improve developer experience, increase risk visibility, and enable secure delivery at scale.
Establish adoption and effectiveness measures to demonstrate Secure SDLC maturity, control integration, developer enablement, reduced friction, and improved product security outcomes.
Lead cross-functional working sessions, develop executive-ready recommendations, and influence process decisions across security and engineering stakeholders without direct authority.

Requirements

Bachelor’s degree in information technology, Cybersecurity, Computer Science, Software Engineering, Information Systems, Engineering, or related field, or the equivalent combination of education, training, and experience.
Experience defining, improving, or integrating secure development lifecycle practices into enterprise software delivery processes.
Strong understanding of secure development practices including threat modeling, secure coding, application security testing, software composition analysis, API security, software supply chain security, vulnerability management, and risk-based exception handling.
Extensive hands-on experience translating security requirements, control objectives, or risk expectations into practical engineering processes, workflow guidance, and delivery requirements.
Demonstrated experience developing process documentation, operating models, workflow diagrams, playbooks, standards, RACI models, implementation guidance, or executive-level recommendations.
Strong facilitation, analytical thinking, systems thinking, problem-solving, communication, and stakeholder influence skills.
Ability to operate independently as a senior individual contributor and lead complex cross-functional initiatives without direct reporting authority.

Technologies

Secure Software Development Lifecycle
Threat modeling
Secure coding
Application security testing
Software composition analysis
API security
Software supply chain security
Vulnerability management
DevSecOps
NIST Secure Software Development Framework
OWASP SAMM
OWASP ASVS
OWASP Top 10
BSIMM
ISO 27001
NIST Cybersecurity Framework
Agile
SAFe
DevOps
CI/CD
Product-oriented delivery
Architecture governance
Release management
CISSP
CISM
CSSLP
CCSP
GIAC

Desired Qualifications

Extensive hands-on experience in application security, secure SDLC, software engineering, DevSecOps, enterprise architecture, technology risk, or software delivery governance.
Strong understanding of software delivery practices including Agile, SAFe, DevOps, DevSecOps, CI/CD, product-oriented delivery, architecture governance, and release management.
Advanced degree in Information Technology, Cybersecurity, Computer Science, Software Engineering, Information Systems, Engineering, Business Administration, or related field.
Experience with industry frameworks or models such as NIST Secure Software Development Framework, OWASP SAMM, OWASP ASVS, OWASP Top 10, BSIMM, ISO 27001, NIST Cybersecurity Framework, or similar security and software assurance practices.
CISSP, CISM, CSSLP, CCSP, GIAC, cloud security, architecture, Agile, SAFe, or related professional certifications.

Work Schedule

Monday - Friday, 8:00AM - 4:30PM

Location

Onsite: 141 Security Drive, Winchester, VA 22602

Bank Secrecy Act

Remains cognizant of and adheres to Navy Federal policies and procedures, and regulations pertaining to the Bank Secrecy Act.

View full job page →

1mo ago

Staff Application Security Engineer

Gemini Trust Company New York, NY

New York, NY

1mo ago Closed

$168k - $240k/yr Full time Agent Ai Security Application Security

This position is no longer accepting applications (closed Sep 9, 2026).

Job Description

Gemini’s AppSec team is hiring a Staff Application Security Engineer to set technical direction for securing high-impact attack surfaces and to build AI-assisted security capabilities across the agentic SDLC.

Responsibilities

Own and continuously improve Gemini Secure Software Development Lifecycle guardrails as an application security subject matter expert
Lead architecture reviews, threat modeling, code reviews, and penetration testing for high-risk applications and services
Design and build AI agents across the SDLC, including:
- Automated threat modeling during design
- AI-driven secure code generation and review
- Reducing AppSec toil
Develop and deliver hands-on application security training to enable engineers at scale
Participate in the Application Security on-call rotation and lead post-incident hardening

Requirements

Proven ability to conduct design reviews, threat modeling, secure code reviews, and penetration testing with an attacker mindset
Strong application security foundation and familiarity with common vulnerabilities such as SSRF, race conditions, and privilege escalations
Deep code review experience in Scala, Java, Go or other common languages, plus hands-on experience in at least Python, Go, or similar for building; comfortable reviewing production services in other languages
Experience implementing custom detection and prevention application security controls to address issues beyond OWASP Top 10
Familiarity with highly regulated environments (financial services, fintech, crypto, or equivalent) and ability to connect business objectives with security risk
Strong cross-functional communication and collaboration with Security, Engineering, and Product
Typically 7-10+ years of experience (or equivalent impact) in application security, product security, or related roles

Preferred Qualifications

Experience building AI application security tooling using agents or related skills
Experience with supply chain security, common frameworks like SLSA and OWASP SPVS, and other CI/CD security controls
Experience preventing application security vulnerabilities at scale through secure design patterns, automated tooling, or frameworks
Experience with microservice architectures and cloud-native environments

Technologies

Scala
Java
Go
Python
OWASP Top 10
SSRF
SLSA
OWASP SPVS

Compensation

Base salary range: $168,000 - $240,000 per year (New York, NY)
Base range does not include discretionary bonus or equity package
Compensation factors include skillset, experience, job scope, and current market data

Benefits

Competitive starting pay
Discretionary annual bonus
Long-term incentive: new hire equity grant
Comprehensive health plans
401K with company matching
Paid Parental Leave
Flexible time off

Work Approach and Location

Hybrid work in the United States at company hub offices
All employees are required to onboard in-person at an office location
Role location: New York, NY (hybrid)

Equal Employment Opportunity

Gemini is committed to equal employment opportunity regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity, or Veteran status
Accommodations are available; contact the People Team for specific needs

View full job page →

Secure Software Development Lifecycle Engineer Jobs

Cybersecurity Engineer (Embedded Systems)

Principal Product Security Engineer

Staff Application Security Engineer

Get Secure Software Development Lifecycle Engineer Jobs alerts