Application Security Engineer (Full Scope Poly)
Concept Plus, LLC2 months ago
Reston, VA, USASenior
Responsibilities
- Integrate security throughout the software development lifecycle for mission applications.
- Partner with developers and cloud engineers on secure application and cloud-native solution design.
- Conduct secure architecture reviews, threat modeling, secure code reviews, security testing, vulnerability remediation, and release authorization support.
- Develop or review applications using Python, JavaScript frameworks, SQL, Shell scripting, PL/SQL, and other programming languages.
- Implement SAST, DAST, SCA, secrets scanning, and container or infrastructure vulnerability scanning processes.
- Build and secure applications and services using Kubernetes, containers, Docker, REST APIs, and CI/CD pipelines.
- Implement DevSecOps practices, including automated security controls and testing in build and deployment pipelines.
- Secure Oracle RDBMS environments through access controls, encryption, auditing, and sensitive-data handling.
- Assess, prioritize, document, and communicate application and cloud security risks and remediation recommendations.
- Support cloud security capabilities including IAM, privileged access controls, secrets management, encryption, logging, monitoring, and incident response.
Requirements
- U.S. citizenship is required.
- A TS/SCI security clearance with polygraph is required.
- At least 8 years of relevant experience in application security, software engineering, DevSecOps, cybersecurity, or a related technical discipline is required.
- A bachelor’s degree in engineering, computer science, or a related technical discipline is required; a master’s degree is preferred.
- Hands-on application security, secure software development, software engineering, or DevSecOps experience is required.
- Experience securing cloud-native applications and services, with Oracle Cloud Infrastructure experience desired.
- Knowledge of NIST RMF, NIST Secure Software Development Framework, OWASP, DISA STIGs, and applicable federal security requirements.
- Experience with security testing processes including SAST, DAST, SCA, secrets scanning, and container or infrastructure vulnerability scanning.
- Preferred certifications include Oracle Cloud Infrastructure IaaS or PaaS certifications and security credentials such as CISSP, CSSLP, Security+, GIAC, CEH, or OSCP.
- Experience with AI technologies for software development, securing AI-enabled applications, or securing development workflows is preferred.
- Data engineering experience involving data validation, business rules, data transformations, and sensitive-data handling is preferred.
- Experience working in an Agile framework is required.
Benefits
- Fully onsite in Reston, Virginia, five days per week.
- Competitive pay, comprehensive health, dental, and vision insurance.
- Paid life insurance, paid time off, and 11 paid holidays.
- Performance bonuses, tuition reimbursement, and unlimited training.
- Collaborative, flexible, and innovative work environment.
Tech Stack
Categories
About Concept Plus, LLC
Concept Plus, LLC is an IT services and consulting firm delivering Oracle-based solutions, cloud engineering, data analytics, and health IT for government and commercial clients. It implements and supports Oracle E‑Business Suite and Fusion Middleware, systems integration, and application modernization, with notable work supporting the U.S. Department of Defense and Defense Health Agency. Founded in 2008 and headquartered in Fairfax, Virginia, it is an Oracle Partner with ISO 9001/20000-1/27001 certifications and a CMMI Level 3 appraisal.