Software Secuirty Engineer - TS/SCI Clearance
CDW Corporation4 days ago
Remote, United StatesSenior
Base Salary
$190k - $230k/yr
Responsibilities
- Perform manual security reviews of source code, pull requests, application changes, and application architectures.
- Assess applications against NIST SP 800-53, NIST SSDF, agency requirements, and applicable DISA Application Security and Development STIG requirements.
- Translate security controls into code-review checklists, acceptance criteria, developer guidance, and validation steps.
- Review authentication, authorization, input validation, session management, logging, secrets management, data protection, and cryptographic implementations.
- Execute and interpret SAST, DAST, SCA, and secrets-scanning results and distinguish actionable vulnerabilities from false positives.
- Evaluate third-party and open-source dependencies and support software component inventory and SBOM activities.
- Partner with developers on code-level remediation, review fixes, and verify closure through retesting and regression testing.
- Participate in threat modeling, application architecture reviews, CI/CD security-gate integration, and secure-coding standards maintenance.
- Document findings, technical impact, requirements, remediation recommendations, and verification evidence.
- Support RMF assessments and ATO activities and communicate unresolved risks and release-readiness recommendations.
Requirements
- Active TS/SCI clearance.
- Professional software engineering experience developing, testing, debugging, and maintaining production applications, including hands-on secure code review or application security experience.
- Proficiency in one or more relevant programming languages, including Java, C#, Python, JavaScript/TypeScript, C/C++, or Go, with the ability to understand unfamiliar codebases.
- Working knowledge of NIST SP 800-53, NIST SSDF, customer-specific security requirements, and applicable DISA STIG checks.
- Strong understanding of application vulnerabilities such as injection, broken access control, insecure authentication, insecure deserialization, and sensitive data exposure.
- Experience with application security testing tools, Git-based version control, peer code review, automated testing, and CI/CD workflows.
- Understanding of web application and API security, least privilege, credential handling, and data protection in transit and at rest.
- Experience producing technical findings and maintaining traceability between requirements, implementation, testing, and remediation evidence.
- Bachelor’s degree in Computer Science, Software Engineering, Cybersecurity, or a related discipline, or equivalent practical experience.
- Experience supporting federal civilian or defense software programs and application security reviews within RMF or ATO processes.
- Hands-on experience applying the DISA Application Security and Development STIG and preparing assessment evidence.
- Experience with Fortify, Checkmarx, CodeQL, Veracode, SonarQube, Snyk, OWASP ZAP, or comparable application security platforms.
- Experience with cloud-native applications, containers, infrastructure as code, and software supply chain security.
- Familiarity with OWASP ASVS, OWASP Top 10, CWE, and risk-based vulnerability prioritization.
- Relevant secure software development or application security certification such as CSSLP or an equivalent credential.
Benefits
- Benefits information is provided at https://cdw.benefit-info.com/.
- Salary ranges may be subject to geographic differentials.
Tech Stack
Categories
About CDW Corporation
CDW Corporation is an IT solutions provider and reseller that designs, supplies, and manages hardware, software, cloud, and cybersecurity for businesses, government, education, and healthcare. Its model combines product resale from major vendors with consulting, managed services, and lifecycle support across data center, networking, and end‑user computing. Founded in 1984 and headquartered in Vernon Hills, Illinois, CDW is publicly traded on NASDAQ.