Software Composition Analysis

Software Composition Analysis Engineer Jobs

2 jobs found

Today

Principal Product Security Engineer

Navy Federal Credit Union Vienna, VA

Vienna, VA

Today

Full time Application Security Application Security Engineering Information Security

Apply Now

Job Description

Principal Product Security Engineer (Secure Development Lifecycle) is a senior individual contributor role focused on defining and embedding secure software development practices into Navy Federal’s software delivery environment.

Responsibilities

Define and mature Secure Software Development Lifecycle (Secure SDLC) practices aligned to Navy Federal software delivery processes, operating models, and secure development practices.
Lead the integration of Secure Development Practice capabilities into engineering workflows, governance forums, and lifecycle activities.
Define and support a pre-production product security scorecard to enable risk-informed release decisions, including communication of product security posture, open risks, exceptions, and required remediation actions to business and technology stakeholders.
Map product security activities across the software delivery lifecycle: intake, planning, architecture review, design, development, testing, release, exception management, and operational handoff.
Establish repeatable process patterns to integrate threat modeling, secure coding, application security testing, software composition analysis, API security, software supply chain security, product integrity testing, and risk-based exception handling.
Identify and reduce redundant reviews, unclear handoffs, late-stage security friction, and legacy steps that do not align with Navy Federal delivery practices.
Develop Secure SDLC operating models, workflow diagrams, playbooks, process documentation, RACI models, control integration points, and implementation guidance.
Translate security standards, objectives, and risk expectations into practical engineering requirements and developer-consumable guidance.
Partner with software engineering, architecture, DevSecOps, Information Security, governance, and risk stakeholders to align secure development with enterprise delivery processes.
Support integration of secure development expectations into architecture governance, delivery boards, exception processes, and lifecycle risk decision points.
Recommend process improvements to strengthen security outcomes, improve developer experience, increase risk visibility, and enable secure delivery at scale.
Establish adoption and effectiveness measures to demonstrate Secure SDLC maturity, control integration, developer enablement, reduced friction, and improved product security outcomes.
Lead cross-functional working sessions, develop executive-ready recommendations, and influence process decisions across security and engineering stakeholders without direct authority.

Requirements

Bachelor’s degree in information technology, Cybersecurity, Computer Science, Software Engineering, Information Systems, Engineering, or related field, or the equivalent combination of education, training, and experience.
Experience defining, improving, or integrating secure development lifecycle practices into enterprise software delivery processes.
Strong understanding of secure development practices including threat modeling, secure coding, application security testing, software composition analysis, API security, software supply chain security, vulnerability management, and risk-based exception handling.
Extensive hands-on experience translating security requirements, control objectives, or risk expectations into practical engineering processes, workflow guidance, and delivery requirements.
Demonstrated experience creating process documentation, operating models, workflow diagrams, playbooks, standards, RACI models, implementation guidance, or executive-level recommendations.
Strong facilitation, analytical thinking, systems thinking, problem-solving, communication, and stakeholder influence skills.
Ability to operate independently as a senior individual contributor and lead complex cross-functional initiatives without direct reporting authority.

Desired Qualifications

Extensive hands-on experience in application security, secure SDLC, software engineering, DevSecOps, enterprise architecture, technology risk, or software delivery governance.
Strong understanding of software delivery practices including Agile, SAFe, DevOps, DevSecOps, CI/CD, product-oriented delivery, architecture governance, and release management.
Advanced degree in Information Technology, Cybersecurity, Computer Science, Software Engineering, Information Systems, Engineering, Business Administration, or related field.
Experience with industry frameworks/models such as NIST Secure Software Development Framework, OWASP SAMM, OWASP ASVS, OWASP Top 10, BSIMM, ISO 27001, NIST Cybersecurity Framework, or similar security and software assurance practices.
CISSP, CISM, CSSLP, CCSP, GIAC, cloud security, architecture, Agile, SAFe, or related professional certifications.

Work Location and Schedule

Location: Vienna, VA (onsite)
Addresses: 820 Follin Lane, Vienna, VA 22180; 5510 Heritage Oaks Drive, Pensacola, FL 32526; 141 Security Drive, Winchester, VA 22602
Hours: Monday - Friday, 8:00AM - 4:30PM

Compliance

Adheres to Navy Federal policies and procedures, and regulations pertaining to the Bank Secrecy Act.

View full job page →

5d ago

Principal Application Security Engineer

Motion Recruitment Charlotte, NC

Charlotte, NC

5d ago

Contract Application Security Application Security Strategy Cybersecurity Tools

Apply Now

Job Description

Motion Recruitment is partnering with a well-known financial services company to hire a Principal Application Security Engineer for a 12-month contract in Charlotte, NC (Hybrid). This role is built for experienced engineering leaders who can shape enterprise application security strategy, modernize AppSec through automation, and expand security capabilities for AI and GenAI applications.

What You’ll Do

Serve as an expert consultant to develop or influence initiatives and resources for complex business and technical needs across Engineering.
Consult on strategy and resolution of highly complex, unique challenges using in-depth evaluation across multiple areas, delivering long-term, large-scale solutions.
Provide technical expertise to client senior leadership and strategically engage with client personnel.
Define and lead the Application Security strategy for DCMS in-scope applications using tier-based control models.
Evaluate current AppSec control coverage, establish baseline mappings by application tier, and identify control gaps.
Drive remediation and onboarding plans with application teams and stakeholders.
Partner with Application Security Champions and engineering teams to support consistent adoption of required AppSec controls.
Ensure alignment with enterprise SDLC requirements and defect remediation expectations.
Identify and deliver AI and GenAI use cases that reduce manual AppSec effort while improving security coverage.
Design and implement automated threat modeling using code, infrastructure-as-code, and application metadata.
Develop adversarial testing for GenAI and LLM-based applications, including prompt injection and abuse scenario coverage.
Lead initiatives for AI model scanning, integrity validation, and secure onboarding of models.
Define protections for AI-specific risks, including insecure prompt construction, tool misuse, and secrets exposure.
Drive modernization of AppSec controls via automation, rationalization, and platform integration.
Build proofs-of-concept and pilot new security capabilities, scaling successful approaches into production.
Influence simplification of AppSec processes to improve developer experience while maintaining strong risk controls.
Provide strategic guidance to senior leadership on Application Security priorities, risks, and investment decisions.
Influence cross-functional teams without direct authority to achieve enterprise security outcomes.
Research emerging threats and technologies and translate findings into actionable AppSec strategy.

Required Qualifications

7+ years of Engineering experience, or equivalent demonstrated through one or a combination of work or consulting experience, training, military experience, or education.
7+ years of Application Security or Information Security Engineering experience at enterprise scale.
Deep expertise in SSDLC controls, including threat modeling, secure design, SAST, SCA, DAST, and penetration testing.
Proven ability to define security strategy and deliver outcomes through influence and technical leadership.
Experience securing GenAI and LLM-based applications, including adversarial testing and prompt-injection defenses.
Experience designing AI-driven security automation or decisioning capabilities.
Strong understanding of DevSecOps and CI/CD security integration.
Experience working in highly regulated environments such as financial services.
Relevant security certifications (CISSP, CSSP, CISM, or equivalent).

Key Technologies

SSDDC, SDLC, SSAST, SCA, DAST, GenAI, LLM, DevSecOps, CI/CD, infrastructure-as-code

View full job page →

Software Composition Analysis Engineer Jobs

Principal Product Security Engineer

Principal Application Security Engineer

Get Software Composition Analysis Engineer Jobs alerts