Security Scanning

Security Scanning Engineer Jobs

4 jobs found

1d ago

System Security Engineer Cyber-Supply Chain Risk Management

PeopleTec, Inc. Huntsville, AL

Huntsville, AL

1d ago

Full time Application Security Cybersecurity Tools Dynamic Application Security Testing

Apply Now

Job Description

PeopleTec, Inc. is seeking a System Security Engineer for Cyber-Supply Chain Risk Management (C-SCRM) to support the Huntsville, AL location onsite. In this role, you will help strengthen the software supply chain by analyzing third-party code, dependencies, and build processes, then translating results into findings and improvement plans for senior leadership through the program PMO.

Why this role

Support a program mission by securing software across the full system lifecycle: design, development, acquisition, integration, testing, fielding, and sustainment.
Own and maintain core supply chain artifacts including SBOM governance, vulnerability reporting, and supplier secure software attestation forms.
Collaborate across a multidisciplinary set of teams and coordinate objectives with internal and external organizations.
Deliver clear, actionable reporting by preparing C-SCRM findings, reports, and improvement plans for senior management and stakeholders.

Responsibilities

Provide technical support and security engineering for C-SCRM across the system lifecycle (design, development, acquisition, integration, testing, fielding, and sustainment).
Mandate and manage Software Bills of Materials (SBOMs) for all procured and open-source software.
Perform deep-dive vulnerability analysis and code provenance checks on third-party libraries.
Establish Software Composition Analysis (SCA) and Static Analysis (SAST) requirements within vendor onboarding.
Develop and maintain the Consolidated Program SBOM, Third-Party Software Vulnerability Reports, and Supplier Secure Software Attestation Forms.
Ensure compliance with defense and industry standards by effectively managing C-SCRM processes.
Interface with internal teams and external organizations to coordinate C-SCRM objectives and strategies.
Prepare and present C-SCRM findings, reports, and improvement plans to senior management and stakeholders.
Conduct strategic planning and coordination aligned to program objectives.
Provide technical expertise to peer engineers within Technology Security, Program Protection, Cyber Security, and Technical Management teams.
Use digital tools and methodologies to analyze supply chain risks, manufacturer/supplier relationships, and foreign ownership and controlling influence.
Complete other tasks as assigned by the Chief Engineer and/or Technical Chief.

Requirements

5+ years of relevant experience. Additional education may be substituted for years of experience.
Demonstrated experience in C-SCRM, particularly in defense or aerospace contexts.
Knowledge of SPDX/CycloneDX, SCA, SAST/DAST, VEX, and FIPS 140-3 validation.
Must meet minimum DoDI 8140.03 Defense Cyber Workforce qualification requirements in one of the following work roles:
- 622 (Secure Software Assessor) at the Intermediate level, or
- 652 (Security Architect) at the Intermediate level.
Strong knowledge of industry standards and defense requirements.
Excellent communication and presentation skills.
Ability to lead and work within a multidisciplinary team.
Previous experience working in a U.S. Government Program Office (required).
Travel: 25%.
U.S. Citizenship required.
DoD Secret clearance is required. Candidates must have an active Secret clearance upon hire and the ability to maintain it.

Technologies

SPDX, CycloneDX
Software Composition Analysis (SCA)
SAST/DAST
VEX
FIPS 140-3

Preferred

Top Secret clearance preferred.
DoDI 8140.03 qualification at the Advanced level for work role 622 (Secure Software Assessor) or 652 (Security Architect).

Program support & coordination

You will provide technical support to the program’s Chief Engineer and Technical Chief, securing the software supply chain by evaluating third-party code, dependencies, and build processes for vulnerabilities and malicious logic before integration across the lifecycle. The role also involves coordination and synchronization of C-SCRM technical and programmatic objectives with internal PMs across PAE Fires and external organizations including HQDA, ASA(ALT), JIATF 401, ATEC, AMCOM, and others.

View full job page →

1mo ago

Application Security Engineer

Veilant Tysons, VA

Tysons, VA

1mo ago Closed

$115k - $145k/yr Full time Application Security Code Security Cybersecurity Tools

This position is no longer accepting applications (closed Sep 15, 2026).

Job Description

Veilant is hiring an Application Security Engineer in Tysons, VA (onsite) to help validate, secure, and continuously improve software delivered by internal and partner engineering teams. In this role, you will work close to development teams while strengthening security through release reviews, threat modeling, secure coding feedback, and DevSecOps tooling improvements. The position offers a salary range of $115,000 to $145,000 annually, plus a benefits package designed to support your health, learning, and day-to-day comfort.

Why you’ll like working here

Flexible PTO + holidays
401k match benefit up to 10%, with an automatic 3% safe harbor contribution and additional matching based on employee contributions
Medical (HSA & PPO Plans Available), dental, vision, disability, and life insurance
Employer contribution to HSA
Learning & Development opportunities
Professional coaching services
Get the technology you want to do your job
Free daily snacks & drinks

Responsibilities

Audit major and minor software release cycles to intercept and remediate security flaws before deployment
Review source code to identify, isolate, validate, and contextualize vulnerabilities in complex application codebases
Build safe proof-of-concept examples to demonstrate exploitation paths and verify real-world impact
Contextualize findings using application business logic, user workflows, data sensitivity, and production use cases
Author clear remediation guidance and partner with development teams to implement patches, controls, or architectural mitigations
Intercept and analyze application-layer network traffic using tools such as Burp Suite or similar intercepting proxies
Assess and help secure core architectures across REST APIs, SQL databases, PostgreSQL, JWT/OAuth, identity providers, and token-based authentication mechanisms
Perform threat modeling for web applications based on use cases, data flows, user roles, trust boundaries, and production environments
Improve DevSecOps pipelines by integrating, tuning, and operationalizing SAST, DAST, SCA, IaC scanning, secrets detection, and container security tooling
Support container runtime security using monitoring and runtime protection tools such as Falco, NeuVector, or similar technologies
Create standardized security reporting that translates technical findings into clear risk narratives for both engineering teams and executive stakeholders
Build and maintain a repeatable AppSec review process for major and minor software releases
Integrate and improve SAST, DAST, and SCA checks in CI/CD pipelines to make security testing a reliable part of the development lifecycle
Establish threat modeling practices using common frameworks and apply them to Veilant’s Angular front-end, Java Spring Boot back-end, REST APIs, SQL databases, and authentication flows
Improve secure coding practices through feedback, remediation guidance, and collaborative reviews
Implement container runtime security best practices including visibility, monitoring, and runtime protections for containerized workloads
Write standardized security reports that communicate risk, impact, and remediation steps for both executive-level stakeholders and engineering teams

Requirements

Ability to obtain a Security Clearance
2+ years of software development experience in Java
Hands-on experience reviewing or securing applications built with Java Spring Boot, Angular, REST APIs, SQL databases, and PostgreSQL
Working knowledge of authentication and authorization technologies including JWT, OAuth, identity providers, Entra, Keycloak, and token-based access models
Experience intercepting, decrypting, manipulating, and analyzing web or application network traffic
Demonstrated ability to find, validate, and explain vulnerabilities in a real codebase
Familiarity with CI/CD tools such as GitLab CI, Azure DevOps, or GitHub Actions
Experience with containerized environments and orchestration tools such as Kubernetes
Exposure to infrastructure-as-code and container scanning tools such as Trivy, Kubesec, or similar technologies
Understanding of cloud hosting environments such as Azure or AWS
Familiarity with secrets management tools such as GitLab Secrets Manager, AWS KMS, Azure Key Vault, or Ansible Vault
Experience with automated application security testing including SAST, DAST, and SCA
Familiarity with runtime security and monitoring tools for containers such as Falco, NeuVector, or similar platforms
Hands-on web security testing experience using Burp Suite or comparable tooling
Strong written communication skills, including the ability to write reports for both technical and non-technical audiences
OSWE, OSCP, and/or GXPN certifications are highly desirable

Physical requirements

Must be able to remain in a stationary position 50% of the time; occasionally move about inside the office
Constantly work with computers and other information technology equipment
Ability to communicate information and ideas in a classroom style format; may stand at a podium for long periods of time

View full job page →

1mo ago

Application Security Engineer - Container Team (W2 ONLY NO C2C)

Matlen Silver Charlotte, NC

Charlotte, NC

1mo ago Closed

Contract Application Security Cloud Platforms Cloud Security

This position is no longer accepting applications (closed Sep 13, 2026).

Job Description

Matlen Silver is hiring an Application Security Engineer for the Container Team in a contract-to-hire role. This position is based onsite in Charlotte, NC, with the contract-to-hire opportunity also available in Atlanta, GA and Raleigh, NC. The work is hands-on and focused on container security, deploying scanning tooling, and strengthening vulnerability workflows across the SDLC.

This is a 4+ month contract with W2 only (no C2C). The role emphasizes practical problem-solving for scanning accuracy and performance, plus clear technical communication with development teams.

Responsibilities

Provide hands-on container security support, including deployment of container scanning tools such as Wiz, Prisma, and Aqua Security.
Troubleshoot complex scanning issues and optimize configurations to improve accuracy and performance.
Apply strong analytical skills to vulnerability triage and risk prioritization.
Consult with development teams and explain technical findings effectively through strong communication.

Requirements

Hands-on experience with container security and deployment of scanning tools (e.g., Wiz, Prisma, Aqua Security).
Proficiency in scripting languages for automation and tool integration, including Python, Bash, or PowerShell.
Deep understanding of the secure software development lifecycle (SDLC) and common vulnerabilities such as the OWASP Top 10.
Ability to troubleshoot complex scanning issues and optimize configurations for accuracy and performance.
Strong analytical skills for vulnerability triage and risk prioritization.
Excellent communication skills for consulting with development teams and explaining technical findings.
Experience integrating security tools into CI/CD pipelines.
Familiarity with cloud-native security across AWS, Azure, and GCP, as well as container orchestration with Kubernetes.
Exposure to DevSecOps practices and security automation frameworks.
Relevant certifications such as OSWE, GWAPT, or CSSLP.

Tools and Technologies

Wiz, Prisma, Aqua Security
Python, Bash, PowerShell
OWASP Top 10
CI/CD
AWS, Azure, GCP
Kubernetes
DevSecOps
OSWE, GWAPT, CSSLP

Benefits

Health, vision, and dental insurance with single and family coverage
401(k) plan with employee contributions only

View full job page →

1mo ago

Security Engineer, Application Security

Mercor New York, NY

New York, NY

1mo ago Closed

$130k - $400k/yr Full time Application Security DevSecOps Information Security

This position is no longer accepting applications (closed Sep 3, 2026).

Job Description

Mercor is building a platform where the application layer is the highest-priority security surface, and security needs to be embedded into day-to-day engineering. In this role, you will own application security end to end, from reviewing code and improving SDLC workflows to integrating security tooling into CI/CD and driving fixes to closure. The platform supports 300K+ experts and enterprise clients that handle sensitive AI training data.

Security Engineer, Application Security will work onsite in New York, NY and will bring 5+ years of professional experience with an application security focus. The compensation range is USD 130,000 - 400,000 per year.

What you’ll do

Embed security review workflows in the SDLC, performing PR-level analysis to catch authentication bugs, injection flaws, and business logic errors before changes ship
Integrate SAST/DAST pipelines into CI/CD to shift security left while keeping deploy velocity intact
Run vulnerability management with prioritization based on real exploitability rather than CVSS score
Define secure coding standards and guardrails that support safer patterns across a team of 50+ engineers
Develop threat models for new features and architecture changes, with special attention to AI data pipelines, payment flows, and multi-tenant boundaries
Operate the bug bounty program, including triaging HackerOne reports, validating findings, and driving remediation through to closure

Requirements

Have found and fixed real vulnerabilities in production applications, not only run scanners
Possess deep web application security knowledge, with OWASP Top 10 as a baseline and the ability to reason about attack chains and business logic flaws
Strength in at least one of Python, TypeScript, or Go, including the ability to review a PR and spot issues such as an auth bypass
Experience building or tuning SAST/DAST tooling, including familiarity with tools such as Semgrep, CodeQL, Snyk, and Burp
Understand modern web frameworks, APIs, and authentication patterns well enough to threat model them
Experience managing a vulnerability pipeline from discovery through prioritization to verified remediation
Bring 5+ years of professional experience in application security, security engineering, or software engineering with a strong security focus

Technologies

Python, TypeScript, Go
Semgrep, CodeQL, Snyk, Burp
HackerOne
OWASP Top 10

Benefits

Bi-annual performance bonus structure
Generous equity grant vested over 4 years
Up to $15k Relocation bonus
$10K housing bonus if you live within 0.5 miles of the office
$1.5K monthly stipend for meals
Free Equinox membership
$200 monthly laundry reimbursement
$200 monthly personal wellness reimbursement
Health, Dental, Vision insurance

Bonus points

Experience running or triaging a bug bounty program (HackerOne, Bugcrowd)
Offensive security skills, including penetration testing experience and an attacker mindset
Experience securing AI/ML applications, including model serving APIs, training data pipelines, and prompt injection defense
Familiarity with supply chain security such as dependency scanning and registry firewalls (Socket, Snyk)
Built custom security tooling that remains in active use by the team
Contributions to open source security projects or published vulnerability research

View full job page →

Security Scanning Engineer Jobs

System Security Engineer Cyber-Supply Chain Risk Management

Application Security Engineer

Application Security Engineer - Container Team (W2 ONLY NO C2C)

Security Engineer, Application Security

Get Security Scanning Engineer Jobs alerts