Application Security Engineer

The Pennsylvania State University; San Diego (CA); On-site; USD 120,000 - 198,000; Full time

Benefits offered by this job

75% tuition discount

Comprehensive benefits package

Job summary

Penn State Lady Lions’ Applied Research Laboratory in San Diego seeks an Application Security Engineer to champion secure software across the full DevSecOps lifecycle. You will embed security in design, code reviews, and testing of APIs, microservices, and containerized apps.

The role requires a strong AppSec background, SAST/DAST/SCA expertise, and familiarity with NIST 800-53 controls; TS/SCI clearance is required. Onsite in San Diego with periodic travel.

Qualifications

• Strong background in application security, secure development, and vulnerability analysis.
• Familiar with SAST, DAST, SCA, and CI/CD security integration.
• Experience reviewing architectures, microservices, and containerized workloads for security weaknesses.
• Familiarity with NIST 800-53 controls as they relate to app security.
• Clear understanding of authentication/authorization, encryption, and API security.

Responsibilities

• Lead integration of application security into Agile/DevSecOps workflows from design through deployment.
• Perform secure code reviews, threat modeling, and architecture analysis to guide remediation.
• Conduct SAST/DAST/IAST and API security testing across microservices and containers.
• Develop secure coding standards and guidance for engineering teams.
• Collaborate with developers to enforce least privilege, secure defaults, and defense in depth.
• Evaluate open source components for vulnerabilities and license risks.
• Guide secure API development, authz/authN, cryptography, and secure data handling.
• Support RMF-related artifacts and contribute to security documentation.

Skills

Application security

Threat modeling

Secure coding practices

CI/CD security integration

Vulnerability analysis

Authentication/Authorization

NIST 800-53 familiarity

Cloud security basics

Education

Bachelor's Degree

Tools

SAST

DAST

SCA

CI/CD security tooling

Secrets scanning

Container security

Job description

POSITION SPECIFICS

This position will be located fully onsite in San Diego, CA. Questions about flexible work arrangements may be directed to the hiring manager during the interview process.

Periodic travel to local and remote test sites is required.

We are seeking a highly skilled Application Security Engineer with a strong foundation in security engineering to join the DevSecOps Team of the Joint Mission Integration and Experimentation (JMIE) Division within the Information Advantage Office at the Applied Research Laboratory (ARL) at Penn State, based in San Diego, CA. The JMIE Division delivers advanced communications capabilities and secure experimentation networks supporting departmental mission partners, including crossdomain data movement, tactical compute environments, and resilient edge processing strengthen secure software design, development, and deployment across our missionfocused environments. In this role, you will champion application security best practices, embed security across the software development lifecycle, and work closely with engineering teams to ensure applications are resilient, compliant, and securely architected from concept to production.

ARL is an authorized DoD SkillBridge partner and welcomes all transitioning military members to apply.

You will:

• Lead the integration of application security best practices into Agile and DevSecOps workflows, ensuring security requirements are included from initial design through deployment
• Conduct deepdive secure code reviews, threat modeling, and architecture analysis to identify vulnerabilities and guide remediation strategies
• Perform static (SAST), dynamic (DAST), and interactive application security testing, ensuring coverage across microservices, APIs, and containerized applications
• Develop and maintain secure coding standards, patterns, and guidance used across engineering teams
• Partner with developers and product owners to ensure secure design decisions, using approaches such as least privilege, secure defaults, zerotrust principles, and defenseindepth
• Manage and optimize tools supporting application security, including SAST/DAST platforms, software composition analysis (SCA), secretscanning, and container/CI pipeline security tool
• Evaluate opensource and thirdparty components for vulnerabilities, license risks, and supply chain integrity
• Guide teams in secure API development, authentication/authorization best practices, cryptographic use, and secure data handling
• Validate security controls and perform risk analysis for applications undergoing release, modernization, or cloud migration
• Assist in building a securityfocused engineering culture through training, documentation, and handson developer engagement
• Collaborate with cybersecurity, cloud, and network teams to ensure application security aligns with enterprise risk, RMF requirements, and overall mission objectives

Additional responsibilities for senior-level roles may include:

• Leading threat modeling sessions, red/blue-team collaboration, and advanced vulnerability analysis
• Designing scalable AppSec programs and enterprise SDLC security strategies
• Supporting RMF documentation and security artifacts relevant to applicationlevel controls
• Acting as a security advisor on highvisibility or missioncritical applications

Required Skills/Experience include:

• Strong background in application security, including secure development practices, vulnerability analysis, and secure design principles
• Versed in SAST, DAST, SCA, and CI/CD security integration
• Proficiency with secure coding techniques in one or more languages (e.g., Python, Java, C#, JavaScript/TypeScript, Go)
• Experience reviewing application architectures, microservices, and containerized workloads for security weaknesses
• Familiarity with NIST 80053 or similar control frameworks as they relate to application-level security requirements
• Strong understanding of authentication, authorization, encryption, and API security best practices
• Strong background in cybersecurity disciplines, including vulnerability management, scanning, compliance evaluation, and control implementation
• Experience interpreting security policy, generating evidence, and documenting test results for NIST 80053 / JSIG security controls
• Active TS/SCI clearance

Preferred Skills/Experience include:

• Experience operating within DevSecOps pipelines and modern CI/CD ecosystems
• Knowledge of cloud-native application security (AWS, Azure, or DoD cloud environments)
• Experience with secure design reviews for APIs, distributed systems, mobile applications, or cross-domain solutions
• Background with eMASS, STIGs, or ACAS in support of application accreditation efforts
• Relevant certifications: CSSLP, GWAPT, GWEB, GCSA, GSSP, or CISSP
• Prior experience delivering developer security training or building secure coding programs

MINIMUM EDUCATION, WORK EXPERIENCE & REQUIRED CERTIFICATIONS

Bachelor's Degree3+ years of relevant experience; or an equivalent combination of education and experience acceptedRequired Certifications:None

ARL's purpose is to research and develop innovative solutions to challenging scientific, engineering, and technology problems in support of the Navy, the Intel Community (IC), and other federal government customers.

BACKGROUND CHECKS/CLEARANCES

Employment with the University will require successful completion of background check(s) in accordance with University policies.Notice regarding employment at the Applied Research Laboratory (ARL):Employees must be eligible to obtain a government security clearance, participate in the ARL drug testing program, and comply with electronic and physical monitoring requirements applicable to federal contractors. ARL operates in a secure information environment involving Unclassified, Controlled Unclassified Information (CUI), and Classified information. Personal electronic devices brought onsite must be registered and may be restricted from certain areas. You must be a U.S. citizen to apply.

SALARY & BENEFITS

The salary range for this position, including all possible grades, is $119,736.00 - $197,604.00. This salary range includes an adjustment based on required geographic work location.

Salary Structure - Information on Penn State's salary structure

Penn State provides a competitive benefits package for full-time employees designed to support both personal and professional well-being. In addition to comprehensive medical, dental, and vision coverage, employees enjoy robust retirement plans and substantial paid time off which includes holidays, vacation and sick time. One of the standout benefits is the generous 75% tuition discount, available to employees as well as eligible spouses and children. For more detailed information, please visit our Benefits Page.

CAMPUS SECURITY CRIME STATISTICS

Pursuant to the Jeanne Clery Disclosure of Campus Security Policy and Campus Crime Statistics Act and the Pennsylvania Act of 1988, Penn State publishes a combined Annual Security and Annual Fire Safety Report (ASR). The ASR includes crime statistics and institutional policies concerning campus security, such as those concerning alcohol and drug use, crime prevention, the reporting of crimes, sexual assault, and other matters. The ASR is available for review here.

EEO IS THE LAW

Penn State is an equal opportunity employer and is committed to providing employment opportunities to all qualified applicants without regard to race, color, religion, age, sex, sexual orientation, gender identity, national origin, disability or protected veteran status. If you are unable to use our online application process due to an impairment or disability, please contact 814-865-1473.

Federal Contractors Labor Law Poster

PA State Labor Law Poster

Penn State Policies

Copyright Information

Hotlines