True Anomaly supports mission-critical engineering work with a security program built for government compliance and real-world operational needs. This onsite role in Denver, CO blends hands-on application security engineering with clear, measurable delivery through vulnerability SLAs and security automation. Expect strong team collaboration, ongoing security enablement, and a total compensation package that includes equity.
Compensation: USD 140,000 - 195,000 per year base salary in Denver. Equity and benefits are included in the total compensation package, and actual base salary may vary based on job-related knowledge and skills, education, location, and experience.
What You’ll Do
- Implement and audit application-level security controls for mission-critical space systems to satisfy government authorization and compliance requirements.
- Create security architecture documentation and operational security guides used for government authorization processes.
- Drive a vulnerability management program with defined remediation timelines of 30/90/180 days based on severity.
- Perform security code reviews across Elixir, Python, C++, and JavaScript codebases.
- Collaborate on triage and management of security automations using SAST (CodeQL, Semgrep), SCA (JFrog Xray), and DAST tooling.
- Partner with engineering teams to address security findings and embed secure coding practices without blocking delivery velocity.
- Develop and deliver security training for software engineers and systems administrators across the organization.
- Create and manage incident response playbooks for application security events.
- Evaluate and integrate third-party security solutions to improve overall security capabilities.
What You’ll Need
- 3+ years of experience in application security, product security, or security engineering.
- Hands-on experience implementing security controls aligned to compliance frameworks such as NIST 800-171, NIST 800-53, FedRAMP, or CMMC.
- Strong software engineering skills with ability to write production-quality code in at least one language: Python, Rust, Elixir, C++, or similar.
- Experience with cloud security (Azure preferred; AWS or GCP acceptable).
- Solid secure architecture fundamentals, including:
- Threat modeling and risk assessment
- Authentication and authorization patterns: OAuth2, JWT, RBAC, ABAC
- Cryptography and key management
- Defense-in-depth and Zero Trust principles
- Ability to work collaboratively with engineering teams to implement controls.
- Eligibility to obtain DoD Secret or TS/SCI clearance.
Technologies You’ll Work With
- Languages/Frameworks: Elixir, Python, C++, JavaScript
- AppSec Automation: CodeQL, Semgrep, JFrog Xray, SAST, SCA, DAST
- Security & Identity: OAuth2, JWT, RBAC, ABAC, Cryptography, Zero Trust
- Cloud: Azure, AWS, GCP
- Compliance: NIST 800-171, NIST 800-53, FedRAMP, CMMC
Benefits
- 100% company-paid medical, dental, and vision coverage for you and your dependents, with HSA/HRA options
- Flexible Time Off (FTO) for exempt employees, accrued PTO up to 25 days for non-exempt employees, plus 12 paid holidays, Parental Leave, and Sick Leave
- Daily catered lunch and unlimited snacks for in-office employees
- 401(k) retirement plan, fitness reimbursement, and Dog Fridays
- Equity participation as part of the total compensation package
Additional Role Details
- Onsite location: Successful candidates must be located near Denver or Long Beach. Significant work must be done on site. #LI-Onsite
- Clearance: This position requires the ability to obtain and maintain a security clearance.
- Export regulations (ITAR): To conform to U.S. Government space technology export regulations, you must be a U.S. citizen, lawful permanent resident of the U.S., protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain required authorizations from the U.S. Department of State.
- Employment note: Do not apply to fixed term and temporary roles.
- Equal opportunity: True Anomaly is committed to equal employment opportunity on any basis protected by applicable state and federal laws, and provides accommodation for disabilities or additional needs upon request.
- Application verification: Third-party tools are used to verify applicant identity and detect fraudulent applications.
Preferred skills are available in the original posting and may include active TS/SCI clearance, direct NIST 800-171 Rev 3 or NIST 800-53 implementation experience, DoD Impact Levels (IL2/IL4/IL5/IL6) or STIGs, functional programming ecosystem familiarity, Azure Government Cloud experience, DevSecOps and platform security engineering background (GitOps, CI/CD security, IaC security, Kubernetes security), security incident response experience, and familiarity with regulated industries or fast-paced startups.
