Application Security Engineer

Leidos; United States; Hybrid; USD 87,000 - 157,000; Full time

Job summary

Leidos in Omaha, Nebraska is seeking an Application Security Engineer to join agile software teams. You will evaluate software dependencies, adjudicate security risks, and work with DevSecOps to remediate findings in a collaborative environment.

The role requires strong JavaScript/web app security skills, familiarity with SBOMs, and expertise in SCA/SAST/DAST. Some on-site work is required with potential for partial remote work.

Qualifications

• US Citizen eligible for TS/SCI within 365 days.
• Bachelor's degree with 4+ years or Master's with 2+ years experience.
• Experience performing application security assessments, vulnerability analysis, and security risk evaluations across enterprise software applications and development environments.
• Experience evaluating third-party libraries, open-source components, and external dependencies for security vulnerabilities, licensing concerns, and software supply chain risks.
• Working knowledge of SCA, SAST, and DAST methodologies and tools.
• Experience analyzing CVEs, CVSS scores, and vulnerability intelligence to assess risk.
• Understanding SSDLC practices, secure coding principles, and application security best practices.
• Familiarity with SBOMs, dependency management, artifact integrity.
• Experience collaborating with software development teams to remediate findings.
• Knowledge of OWASP Top 10 and CWE classifications.
• Ability to communicate findings to technical and program stakeholders.

Responsibilities

• Independently evaluate software dependencies, assess risk, approve or reject components, and document defensible technical decisions.
• Apply SBOMs, transitive dependencies, component provenance, vulnerability intelligence, and artifact integrity to improve software supply chain security.
• Evaluate vulnerabilities in context of actual application use, not just CVSS scores.
• Collaborate with software engineers and DevSecOps teams to resolve security findings without blocking development velocity.
• Use Jira, Confluence, Nexus, Git, and related tools to track and report.
• Support creation and updating of design, development, and testing documentation.

Skills

Application security assessments

Vulnerability analysis

Security risk evaluations

SBOMs

SCA/SAST/DAST

CVEs/CVSS analysis

SSDLC

Dependency management

OWASP Top 10

Stakeholder communication

Education

Bachelor's degree in a relevant field

Master's degree

Tools

Jira

Confluence

Nexus IQ

JFrog Xray

Black Duck

Snyk

Mend

Dependency-Track

Fortify

Checkmarx

Veracode

Semgrep

SonarQube

Sigstore

Job description

Description

Application Security Engineer

Omaha, NE

No Clearance Required to Start

Must be able to Obtain a TS/SCI

The Defense Sector at Leidos is seeking a talented Application Security Engineer to join our dynamic Agile software teams in Omaha, Nebraska. This opportunity will provide professional growth that is singularly focused on providing world class solutions to our customers in an exciting, collaborative, and inclusive environment. You will be challenged and provided with a tremendous opportunity to expand your skills in a customer-facing, fast-paced, and rewarding environment.

In this role, the successful candidate has significant experience in building modern JavaScript-based web applications, including familiarity with multiple frameworks, strong programming fundamentals, and typical web application development and deployment processes, as well as cybersecurity experience. We're looking for someone who can make risk-based security adjudication decisions, not simply operate vulnerability scanning tools! You must be capable of working on multiple projects at once and seeing them all through to completion, and a self-starter who is able to work through any obstacles to get the job done.

Most of the work will be on site in Leidos' facility in Omaha, Nebraska. Some level of remote/work from home is possible.

Primary Responsibilities:

• Independently evaluate software dependencies, assess risk, approve or reject components, and document defensible technical decisions.
• Apply your knowledge of SBOMs, transitive dependencies, component provenance, vulnerability intelligence, and artifact integrity in order to improve software supply chain security.
• Evaluate vulnerabilities in the context of actual application use, rather than relying solely on automated scan results or CVSS scores.
• Work directly with software engineers and DevSecOps teams to resolve security findings without unnecessarily impeding development velocity.
• Use Jira, Confluence, Nexus, Git, development operations, collaboration, and source control tools.
• Support creation and updating of all relevant documentation and specifications for design, development, and testing.

Basic Qualifications:

• US Citizen with the ability to obtain and maintain a TS/SCI within 365 days of your start date with Leidos.
• Bachelor's degree with 4+ years of experience or a Master's degree with 2+ years of experience. Additional experience may be considered in lieu of a degree.
• Experience performing application security assessments, vulnerability analysis, and security risk evaluations across enterprise software applications and development environments.
• Experience evaluating and adjudicating third-party software libraries, open-source components, and external dependencies for security vulnerabilities, licensing concerns, and software supply chain risks.
• Working knowledge of Software Composition Analysis (SCA), Static Application Security Testing (SAST), and Dynamic Application Security Testing (DAST) methodologies and tools.
• Experience analyzing Common Vulnerabilities and Exposures (CVEs), Common Vulnerability Scoring System (CVSS) scores, and vulnerability intelligence to assess applicability, exploitability, and operational risk.
• Understanding secure software development lifecycle (SSDLC) practices, secure coding principles, and application security best practices.
• Familiarity with software supply-chain security concepts, including dependency management, Software Bills of Materials (SBOMs), artifact integrity, and vulnerability remediation.
• Experience collaborating with software development teams to identify, prioritize, document, and remediate application security findings.
• Working knowledge of common application security risks and vulnerabilities, including the OWASP Top 10 and CWE classifications.
• Ability to develop technical security assessments, document risk-based adjudication decisions, and communicate findings and recommendations to technical and program stakeholders.

Preferred Qualifications:

• US Citizen with an active TS/SCI security clearance.
• Experience supporting application security activities within DoD, Intelligence Community, or other highly regulated and security-sensitive software development environments.
• Experience with modern software development (Java, Python, Javascript, Rust, etc).
• Experience implementing or managing third-party library approval and adjudication processes, including evaluation of component provenance, known vulnerabilities, transitive dependencies, licensing restrictions, and available mitigation strategies.
• Hands-on experience with SCA and vulnerability management tools such as Sonatype Nexus IQ, JFrog Xray, Black Duck, Snyk, Mend, Dependency-Track, or equivalent platforms.
• Experience with application security testing tools such as Fortify, Checkmarx, Veracode, Semgrep, SonarQube, or equivalent technologies.
• Experience generating, analyzing, and maintaining SBOMs using industry-standard formats such as CycloneDX and SPDX.
• Familiarity with software supply chain security frameworks and guidance, including NIST SP 800-218 (SSDF), NIST SP 800-53, NIST SP 800-161, and relevant CISA guidance.
• Experience assessing vulnerability exploitability and prioritizing remediation using VEX, CISA Known Exploited Vulnerabilities (KEV), EPSS, and other threat intelligence sources.
• Experience integrating automated security scanning, dependency analysis, and compliance checks into CI/CD pipelines and DevSecOps workflows.
• Experience securing containerized applications, container images, and Kubernetes-based deployment environments.
• Understanding of software artifact repositories, package managers, and dependency ecosystems such as Maven, Gradle, npm, NuGet, PyPI, and Cargo.
• Experience evaluating software component provenance, artifact signing, integrity verification, and build-pipeline security using technologies such as Sigstore, SLSA, or equivalent approaches.
• Ability to evaluate vulnerability findings in the context of actual application architecture, runtime behavior, and operational exposure to distinguish exploitable risks from false positives or non-applicable findings.
• Experience developing security policies, risk acceptance criteria, vulnerability exception processes, and documented mitigation strategies.
• Experience with Risk Management Framework (RMF), Authority to Operate (ATO) processes, and security control assessment activities.
• Experience scripting or automating security analysis workflows using Python, PowerShell, Bash, or similar technologies.
• Familiarity with secure development practices for Java, C/C++, Rust, JavaScript, or other enterprise programming languages.
• Relevant industry cybersecurity certifications such as CISSP, CSSLP, Security+, or GIAC GWEB.
• Experience with USSTRATCOM Nuclear Planning process.

If you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo - because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 - and moving faster than anyone else dares.

Original Posting:

November 6, 2026

For U.S. Positions: While subject to change based on business needs, Leidos reasonably anticipates that this job requisition will remain open for at least 3 days with an anticipated close date of no earlier than 3 days after the original posting date as listed above.

Pay Range:

Pay Range $87,100.00 - $157,450.00

The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.

About Leidos

Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations. Headquartered in Reston, Virginia, with 47,000 global employees, Leidos reported annual revenues of approximately $16.7 billion for the fiscal year ended January 3, 2025. For more information, visit www.Leidos.com .

Pay and Benefits

Pay and benefits are fundamental to any career decision. That's why we craft compensation packages that reflect the importance of the work we do for our customers. Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement. More details are available at www.leidos.com/careers/pay-benefits .

Securing Your Data

Beware of fake employment opportunities using Leidos' name. Leidos will never ask you to provide payment-related information during any part of the employment application process (i.e., ask you for money), nor will Leidos ever advance money as part of the hiring process (i.e., send you a check or money order before doing any work). Further, Leidos will only communicate with you through emails that are generated by the Leidos.com automated system - never from free commercial services (e.g., Gmail, Yahoo, Hotmail) or via WhatsApp, Telegram, etc. If you received an email purporting to be from Leidos that asks for payment-related information or any other personal information (e.g., about you or your previous employer), and you are concerned about its legitimacy, please make us aware immediately by emailing us at [e-mail] .

If you believe you are the victim of a scam, contact your local law enforcement and report the incident to the U.S. Federal Trade Commission .

Commitment to Non-Discrimination

All qualified applicants will receive consideration for employment without regard to sex, race, ethnicity, age, national origin, citizenship, religion, physical or mental disability, medical condition, genetic information, pregnancy, family structure, marital status, ancestry, domestic partner status, sexual orientation, gender identity or expression, veteran or military status, or any other basis prohibited by law. Leidos will also consider for employment qualified applicants with criminal histories consistent with relevant laws.