Senior Application Security Engineering Lead

Responsibilities - Perform application security analysis using both automated and manual techniques, including: - Static code analysis (SAST) - Software composition analysis (SCA) - Fuzzing - Manual code and design reviews - Lead an application security team in support of multiple programs - Identify, analyze, and help remediate application vulnerabilities - Support software engineers in integrating security considerations into system and application designs - Integrate and maintain application security tooling within CI/CD and DevSecOps pipelines - Design, implement, and improve continuous integration security analysis tooling - Tune and maintain security tools to reduce false positives and improve signal quality - Assist development teams in understanding findings and implementing effective fixes - Support threat modeling and secure design reviews - Stay current with emerging vulnerabilities, attack techniques, and mitigation strategies - Document findings, recommendations, and best practices - Perform other duties as assigned ## Requirements - Bachelor's degree plus 8+ years of professional experience in cybersecurity or software development, or equivalent experience - 2+ years of experience focused on application/software security - Experience analyzing source code for security flaws - Familiarity with secure software development practices - Strong analytical and problem-solving skills - Detail-oriented with strong written and verbal communication abilities - Ability to qualify for and maintain a DoD Secret security clearance - Ability to meet DoD 8140.01 Cyberspace Workforce Management requirements within six months of hire - Ability to effectively collaborate with government customer team members and other engineers Candidates who have any of the following skills will be preferred: - Active DoD Secret clearance or higher - Experience identifying, exploiting, and remediating application vulnerabilities - Credit for published CVEs is a strong plus - Proficiency in one or more programming languages such as C++, Python, JavaScript, Rust - Experience configuring and operating static analysis tools (e.g., Coverity, Klocwork, SonarQube) - Experience configuring and operating software composition analysis tools (e.g., Snyk, Sonatype, Anchore, JFrog Xray) - Experience with fuzzing frameworks (AFL, AFL++, honggfuzz, or similar) - Experience with debugging, runtime instrumentation, or reverse engineering, including tools such as strace, eBPF, Ghidra or IDA Pro - Familiarity with threat modeling methodologies and frameworks such as MITRE ATT&CK - Experience working in DevSecOps or Agile development environments *Resumes, Cover Letters, and Applications which are generated by AI will not be considered for employment. Colorado Residents: In any materials you submit, you may redact or remove age-identifying information such as age, date of birth, or dates of school attendance or graduation. You will not be penalized for redacting or removing this information. ## Benefits SciTec offers a highly competitive salary and benefits package, including: - 4% Safe Harbor 401(k) match - 100% company paid HSA Medical insurance, with a choice of 2 buy-up options - 80% company paid Dental insurance - 100% company paid Vision insurance - 100% company paid Life insurance - 100% company paid Long-term Disability insurance - 100% company paid Hospital Indemnity insurance - Voluntary Accident and Critical Illness insurance - Short-term Disability insurance - Annual Profit-Sharing Plan - Discretionary Performance Bonus - Paid Parental Leave - Generous Paid Time Off, including Holiday, Vacation, and Sick Pay - Flexible Work Hours The pay range for this position is $155,000 - $185,000 / year. SciTec considers several factors when extending an offer of employment, including but no limited to the role and associated responsibilities, a candidate's work experience, education/training, and key skills. This is not a guarantee of compensation. SciTec is proud to be an Equal Opportunity employer. VET/Disabled.