Application Security Engineer - Secure SDLC & DoD

CACI; United States; On-site; USD 75,000 - 158,000; Full time

Job summary

CACI is seeking an experienced Application Security Engineer to join our mission‑driven cybersecurity team supporting a critical DoD mission.

You will embed security into the secure SDLC from design through deployment, perform SAST/DAST, lead penetration testing, and document findings with actionable remediation while traveling quarterly to Scott Air Force Base.

Applicants should have 3–5 years in application security, strong OWASP Top 10 knowledge, and Fortify experience, with DoD clearance.

Qualifications

• Active Secret or TS clearance.
• 3–5 years of experience in application security, secure development, or penetration testing.
• Hands‑on experience with SAST platforms (Fortify preferred).
• Working knowledge of OWASP Top 10 and common application vulnerability classes.
• Demonstrated experience conducting or supporting penetration tests.
• DoD 8140M DCWF Basic Tier — CEH.
• DoD 8140 Interim Education Options.
• Required to travel to Scott Air Force Base on a quarterly basis.

Responsibilities

• Embed security into the secure SDLC from design through deployment.
• Execute static (SAST) and dynamic (DAST) application security testing using enterprise tooling.
• Lead and support penetration testing engagements; guide developers through remediation.
• Work with architecture, GRC, and operations teams within the cybersecurity program.
• Grow expertise across AppSec: code review, runtime testing, and compliance validation.

Skills

SAST

DAST

Penetration testing

OWASP Top 10

Fortify

DoD 8140

Education

Bachelor or higher (preferred)

DoD 8140 education options

Tools

Fortify

SonarQube

Job description

CACI is seeking an experienced Application Security Engineer to join our mission‑driven cybersecurity team supporting a critical DoD mission.

You will embed security into the secure SDLC from design through deployment, perform SAST/DAST, lead penetration testing, and document findings with actionable remediation while traveling quarterly to Scott Air Force Base.

Applicants should have 3–5 years in application security, strong OWASP Top 10 knowledge, and Fortify experience, with DoD clearance.