3 days ago
Omaha, NE, USAMid Level
H1B sponsor
Base Salary
$87k - $157k/yr
Responsibilities
- Evaluate software dependencies, assess risk, approve or reject components, and document defensible technical decisions.
- Analyze SBOMs, transitive dependencies, component provenance, vulnerability intelligence, and artifact integrity to improve software supply-chain security.
- Assess vulnerabilities based on actual application use, architecture, runtime behavior, and operational exposure.
- Collaborate with software engineers and DevSecOps teams to resolve security findings without unnecessarily slowing development.
- Use Jira, Confluence, Nexus, Git, development operations, collaboration, and source-control tools.
- Create and update documentation and specifications for design, development, and testing.
- Develop technical security assessments, risk-based adjudication decisions, mitigation strategies, security policies, risk acceptance criteria, and vulnerability exception processes.
Requirements
- U.S. citizenship and the ability to obtain and maintain a TS/SCI clearance within 365 days of starting.
- Bachelor’s degree with 4+ years of experience or master’s degree with 2+ years of experience; additional experience may substitute for a degree.
- Experience with application security assessments, vulnerability analysis, security risk evaluations, and third-party software component adjudication.
- Working knowledge of SCA, SAST, and DAST methodologies and tools.
- Experience analyzing CVEs, CVSS scores, vulnerability intelligence, exploitability, and operational risk.
- Understanding of SSDLC practices, secure coding, application security risks, OWASP Top 10, CWE classifications, and software supply-chain security.
- Experience collaborating with development teams to identify, prioritize, document, and remediate application security findings.
- Preferred experience with Java, Python, JavaScript, Rust, C/C++, security scanning tools, SBOM formats, CI/CD and DevSecOps workflows, containers, Kubernetes, package ecosystems, artifact signing, RMF, ATO processes, and security-control assessments.
- Preferred certifications include CISSP, CSSLP, Security+, or GIAC GWEB.
- Experience with DoD, Intelligence Community, or other regulated software environments and USSTRATCOM Nuclear Planning is preferred.
Benefits
- Most work is onsite at the Leidos facility in Omaha, Nebraska, with some remote or work-from-home flexibility.
- No clearance is required to start, but the employee must be able to obtain a TS/SCI clearance.
Tech Stack
Categories
About Leidos
Leidos builds and operates technology and engineering solutions for defense, intelligence, civil, and health agencies, including systems integration, cyber, enterprise IT, sensors, and healthcare IT. It primarily sells through government contracts and long-term programs, plus managed services and mission software. Founded in 1969 and headquartered in Reston, Virginia, Leidos is a Fortune 500 public company on the NYSE; customers include U.S. defense and intelligence agencies and civil bodies such as the FAA.