Application Security Engineer

Cybersecurity Jobs; Leander (TX); On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Health, dental, vision

Parental leave

Relocation benefits

Educational reimbursement

Short term disability

Flexible PTO

Job summary

Firefly Aerospace in Leander, TX is seeking an Application Security Engineer to harden the ground software stack across front-end, back-end, databases, and cloud services. This onsite role emphasizes secure development, code reviews, and governance for mission-critical systems.

You will integrate SAST/DAST into CI/CD pipelines, enforce secure coding practices, and support ATO processes in regulated environments, collaborating with DevOps and engineering teams.

Qualifications

• BS in Computer Science, Software Engineering, Cybersecurity, or related field.
• 5+ years of software engineering experience focused on application security.
• Proficiency with modern programming frameworks, including React, Node.js, and Python.
• Hands-on experience with vulnerability scanning and application security testing tools such as SonarQube, Snyk, Fortify, Veracode, and OWASP ZAP.
• Strong knowledge of secure coding practices, including OWASP Top 10 and CWE Top 25.
• Knowledge of security standards including NIST 800-53, DoD STIGs, and FIPS 140-3.
• Experience with container and cloud security, including Docker, Kubernetes, AWS IAM, and Secrets Management.
• Familiarity with CI/CD security integration.
• Strong understanding of authentication and authorization, TLS, and secure secret handling.
• Experience in high‑reliability, safety‑critical, or regulated environments.

Responsibilities

• Design, implement, and maintain security controls for spacecraft ground software across front-end, back-end, databases, and cloud services.
• Run software scanning, code reviews, and vulnerability assessments using industry-standard tooling and processes.
• Define and enforce secure coding practices across development teams.
• Integrate SAST/DAST into CI/CD pipelines as part of the secure development workflow.
• Partner with developers to remediate vulnerabilities and implement secure architectures.
• Translate and implement government and national security standards, including NIST and DoD STIGs.
• Architect and maintain IAM, including RBAC, and ensure secure API authentication.
• Work with DevOps to deploy hardened software in containerized and cloud environments using Docker, Kubernetes, and AWS IAM.
• Support audits, security reviews, and ATO processes for classified and mission-critical systems.

Skills

Application security

Secure coding practices

Team collaboration

High-reliability environments

Education

BS in Computer Science / related field

Tools

React

Node.js

Python

SonarQube

Snyk

Fortify

Veracode

OWASP ZAP

OWASP Top 10

CWE Top 25

NIST 800-53

DoD STIGs

FIPS 140-3

Docker

Kubernetes

AWS IAM

Secrets Management

CI/CD

SAST/DAST

TLS

Job description

Firefly Aerospace is hiring an Application Security Engineer for onsite work in Leander, TX. This role supports mission-critical spacecraft operations by securing the ground software stack end to end, helping ensure strong security controls across applications, cloud services, and identity systems.

You will help design and enforce security policies, integrate secure development practices into CI/CD, and support the security lifecycle for systems that require careful governance and review, including security testing and Authority to Operate (ATO) processes for classified and mission-critical environments.

Responsibilities

• Design, implement, and maintain security controls for spacecraft ground software across front-end, back-end, databases, and cloud services.
• Run software scanning, code reviews, and vulnerability assessments using industry-standard tooling and processes.
• Define and enforce secure coding practices across development teams.
• Integrate SAST/DAST into CI/CD pipelines as part of the secure development workflow.
• Partner with developers to remediate vulnerabilities and implement secure architectures.
• Translate and implement government and national security standards, including NIST and DoD STIGs.
• Architect and maintain IAM, including role-based access controls, and ensure secure API authentication.
• Work with DevOps to deploy hardened software in containerized and cloud environments using Docker, Kubernetes, and AWS.
• Support audits, security reviews, and ATO processes for classified and mission-critical systems.

Requirements

• BS in Computer Science, Software Engineering, Cybersecurity, or a related technical field.
• 5+ years of software engineering experience focused on application security.
• Proficiency with modern programming frameworks, including React, Node.js, and Python.
• Hands‑on experience with vulnerability scanning and application security testing tools such as SonarQube, Snyk, Fortify, Veracode, and OWASP ZAP.
• Strong knowledge of secure coding practices, including OWASP Top 10 and CWE Top 25.
• Knowledge of security standards including NIST 800-53, DoD STIGs, and FIPS 140-3.
• Experience with container and cloud security, including Docker, Kubernetes, AWS IAM, and Secrets Management.
• Familiarity with CI/CD security integration.
• Strong understanding of authentication and authorization, including correct encryption implementation using vetted libraries, TLS, and secrets handling.
• Experience working in high‑reliability, safety‑critical, or regulated environments.

Technology Stack

React, Node.js, Python, SonarQube, Snyk, Fortify, Veracode, OWASP ZAP, OWASP Top 10, CWE Top 25, NIST 800-53, DoD STIGs, FIPS 140-3, Docker, Kubernetes, AWS IAM, Secrets Management, CI/CD, SAST/DAST, TLS, Authority to Operate (ATO)

Benefits

• Generous health, dental, and vision plans with low plan deductibles
• Parental leave
• Relocation benefits
• Educational reimbursement
• Short term disability
• Flexible PTO options

Desired

• Advanced degree or equivalent hands‑on experience in a related technical field.
• Experience deploying software to classified or government systems.
• Prior involvement in achieving or maintaining an ATO.
• Background in mission-critical or aerospace ground systems.
• Hands‑on experience supporting incident response from the remediation side, including root‑cause analysis, coordinating fixes, and hardening.
• Active security clearance (Secret or higher) or eligibility to obtain one.
• Security certifications such as CISSP, CSSLP, CEH, or GIAC.