Application Security Engineer
The Pennsylvania State University3 days ago
San Diego, CA, USAMid Level
Base Salary
$92k - $152k/yr
Responsibilities
- Integrate application security practices and requirements into Agile and DevSecOps workflows from design through deployment.
- Conduct secure code reviews, threat modeling, architecture analysis, vulnerability analysis, and remediation guidance.
- Perform SAST, DAST, interactive application security testing, software composition analysis, secret scanning, and container and CI pipeline security activities.
- Develop secure coding standards, patterns, guidance, documentation, and developer training programs.
- Advise engineering teams on secure APIs, authentication, authorization, cryptography, secure data handling, least privilege, zero-trust principles, and defense in depth.
- Evaluate open-source and third-party components for vulnerabilities, license risks, and software supply-chain integrity.
- Validate security controls and perform risk analysis for application releases, modernization, and cloud migration.
- Collaborate with cybersecurity, cloud, and network teams on enterprise risk, RMF requirements, security controls, and mission objectives.
- For senior-level assignments, lead threat modeling and red/blue-team collaboration, design enterprise SDLC security strategies, support RMF artifacts, and advise on mission-critical applications.
Requirements
- Bachelor’s degree and 3+ years of relevant experience, or an equivalent combination of education and experience.
- Strong application security background, including secure development, vulnerability analysis, and secure design principles.
- Proficiency with SAST, DAST, SCA, and CI/CD security integration.
- Secure coding proficiency in one or more of Python, Java, C#, JavaScript/TypeScript, or Go.
- Experience reviewing application architectures, microservices, and containerized workloads for security weaknesses.
- Familiarity with NIST 800-53 or similar control frameworks and application-level security requirements.
- Strong knowledge of authentication, authorization, encryption, API security, vulnerability management, scanning, compliance evaluation, and control implementation.
- Experience interpreting security policy, generating evidence, and documenting test results for NIST 800-53 or JSIG security controls.
- Active TS/SCI clearance and U.S. citizenship; candidates must be eligible to obtain a government security clearance.
- Preferred qualifications include DevSecOps and CI/CD experience, cloud-native application security with AWS, Azure, or DoD cloud environments, secure design reviews, eMASS, STIGs, ACAS, developer security training, or secure coding program development.
- Preferred certifications include CSSLP, GWAPT, GWEB, GCSA, GSSP, or CISSP.
Benefits
- Full-time employees receive medical, dental, and vision coverage, retirement plans, holidays, vacation, and sick time.
- Employees and eligible spouses and children receive a 75% tuition discount.
- The position is fully onsite in San Diego, California, with periodic travel to local and remote test sites required.
- Employment requires background checks, participation in the ARL drug testing program, and compliance with electronic and physical monitoring requirements.
- The role is within a secure environment involving Unclassified, Controlled Unclassified Information, and Classified information; personal electronic devices may be restricted onsite.
Tech Stack
Categories
About The Pennsylvania State University
The Applied Research Laboratory at Penn State is a University Affiliated Research Center that delivers contract research, prototyping, and systems engineering for U.S. national security and related sponsors. Its work spans undersea systems, communications, navigation, acoustics, fluid dynamics, and advanced materials and manufacturing. Founded in 1945 and based in State College, Pennsylvania, ARL operates within The Pennsylvania State University and is funded largely through federal contracts and grants.