Application Security Engineer – Software Vulnerability Remediation

Cybersecurity Jobs; Reston (VA); Hybrid; USD 130,000 - 150,000; Full time

Benefits offered by this job

Health insurance

Life insurance

401(k)

Job summary

CONCEPT SOLUTIONS LLC is supporting a mission-critical application modernization program for a Department of War customer, focusing on remediation of security findings in production across an application portfolio. You will drive fixes with development teams and align security documentation to continuous monitoring needs.

The role requires 4+ years in application security or secure software engineering, with hands-on experience in Java or Go apps, production environments, and familiarity with

Qualifications

• 4+ years of experience in application security, secure software engineering, or a closely related discipline.
• Hands-on experience identifying and remediating security vulnerabilities in Java or Go applications.
• Experience addressing security findings within production software environments.

Responsibilities

• Identify and remediate security findings across existing production applications, including dependency vulnerabilities, container vulnerabilities, STIG compliance issues, and code-level findings from security scans and assessments.
• Maintain accurate and current Plans of Action and Milestones (POA&Ms) for the application portfolio, tracking security findings and remediation progress.
• Collaborate with the Information System Security Engineer (ISSE) to develop and maintain application security evidence for continuous monitoring requirements.
• Work with software development squads to implement secure coding fixes and address vulnerabilities in application codebases.
• Support ongoing application security improvements while ensuring continued operation and sustainment of production applications.

Skills

Application security

Java

Go (Golang)

Syft

Grype

Tools

Java

Go (Golang)

Syft

Grype

Job description

CONCEPT SOLUTIONS LLC is supporting a mission-critical application modernization program for a Department of War customer, and this Application Security Engineer role focuses on software vulnerability remediation in production environments. You will help locate security issues across an application portfolio, drive fixes in partnership with development teams, and keep security documentation aligned to continuous monitoring needs.

What you’ll do

• Identify and remediate security findings across existing production applications, including dependency vulnerabilities, container vulnerabilities, STIG compliance issues, and code-level findings from security scans and assessments.
• Maintain accurate and current Plans of Action and Milestones (POA&Ms) for the application portfolio, tracking security findings and remediation progress.
• Collaborate with the Information System Security Engineer (ISSE) to develop and maintain application security evidence for continuous monitoring requirements.
• Work with software development squads to implement secure coding fixes and address vulnerabilities in application codebases.
• Support ongoing application security improvements while ensuring continued operation and sustainment of production applications.

What you bring

• 4+ years of experience in application security, secure software engineering, or a closely related discipline.
• Hands-on experience identifying and remediating security vulnerabilities in Java or Go (Golang) applications.
• Experience addressing security findings within production software environments.

Tools and technologies

• Java
• Go (Golang)
• Syft
• Grype

Security and compliance focus

• Maintain or support application security evidence aligned to continuous monitoring.
• Support and address STIG compliance issues as part of remediation work.

Nice to have

• Experience using software vulnerability scanning tools such as Syft, Grype, or similar technologies.
• Familiarity with Security Technical Implementation Guides (STIGs).
• Active Secret security clearance.

Location, schedule, and logistics

• Location: Hybrid. Reston, VA headquarters and approved remote locations within the United States, with on-site work at Government facilities in Northern Virginia and Maryland as required.
• Equipment: Government-furnished equipment is used for access to Government environments.
• Schedule: Full-time, 40 hours per week, Monday through Friday, with core hours of 9:00 a.m. to 3:00 p.m. Eastern.
• Delivery cadence: Work is organized into two-week sprints, with a customer demonstration each sprint.
• Travel: 0–10% within the Washington, DC metropolitan area.

Clearance and eligibility

• U.S. citizenship required. Must be eligible to obtain and maintain a DoW security clearance.
• An active Secret clearance or higher is strongly preferred and may allow an earlier start.

Compensation and benefits

• Base salary: $130,000–$150,000 annually, depending on experience.
• Health insurance: Health, dental, and vision insurance.
• Life insurance: Life insurance.
• Retirement: Comprehensive 401(k) plan with matching and immediate vesting.

This position is contingent upon contract award, with an anticipated start in October 2026.