Application Security Tools Engineer

Advanced Onion; Monterey (CA); On-site; USD 150,000 - 190,000; Full time

Job summary

Advanced Onion, Inc. is seeking an Application Security Tooling Engineer to design, operate, and continuously improve the AppSec scanning ecosystem across the SDLC.

You will integrate SCA with Sonatype, SAST with Fortify, StackRox for container security, and Burp Suite for DAST to ensure scalable, auditable security controls in regulated environments. The ideal candidate has hands-on experience deploying and tuning tools, integrating them into CI/CD, and guiding policy gates.

Qualifications

• Active Secret clearance required.
• 5+ years in application security engineering and/or DevSecOps in regulated environments.
• Hands-on administration and pipeline integration with listed tools.
• Strong CI/CD and automation skills; able to implement repeatable integrations and policy gates.

Responsibilities

• Own platform operations for AppSec tooling across the SDLC.
• Deploy, configure, harden, and maintain Sonatype, Fortify, StackRox, and Burp in on-prem or cloud environments.
• Manage upgrades, plugins, licensing, capacity planning, backup/restore, HA, and DR.
• Establish SLAs/SLOs, monitoring/alerting, and operational runbooks.
• CI/CD integration and policy-based gating in pipelines.

Skills

CI/CD automation

DevSecOps

Security tooling expertise

Vulnerability management

Tools

Sonatype Nexus IQ/Lifecycle

Fortify SCA/SSC

StackRox/Red Hat ACS

Burp Suite

Jira

Job description

Application Security Tooling Engineer (Sonatype, Fortify, StackRox, Burp Suite)

Position Overview

We are seeking an Application Security Tooling Engineer to design, operate, and continuously improve the a defense agency's application security (AppSec) scanning ecosystem across the software development life cycle (SDLC). This position will run and integrate software composition analysis (SCA) with Sonatype, static application security testing (SAST) with Fortify, container/Kubernetes security with Red Hat Advanced Cluster Security (StackRox), and dynamic application security testing (DAST) with Burp Suite‑ensuring scalable, auditable, mission‑ready security controls in regulated environments. The ideal candidate is comfortable performing tool assessments and recommendations to Senior Executive leaders (in commercial/Federal) to potentially reduce tools, but is comfortable operating all tools listed.

Key Responsibilities

• Platform ownership & operations
• Deploy, configure, harden, and maintain Sonatype, Fortify, StackRox, and Burp in on-prem and/or accredited cloud environments. The strongest candidates possess Oracle Cloud experience/certifications.
• Manage upgrades, plugins, licensing, capacity planning, backup/restore, high availability, and disaster recovery.
• Establish SLAs/SLOs, monitoring/alerting, and operational runbooks.
• CI/CD integration (DevSecOps)
• Integrate tools into CI/CD pipelines (e.g., Jenkins, GitLab CI, etc.) with policy-based gating and risk-based exceptions.
• Standardize developer 'secure-by-default' workflows: pull request checks, nightly scans, release readiness criteria.
• Build reusable templates and reference implementations for product teams.
• Security policy, tuning, and governance
• Define and tune scanning policies (severity thresholds, exploitability context, allowlists/denylists, quality gates) aligned to agency standards.
• Reduce false positives/negatives through rule tuning, calibration, and developer feedback loops.
• Maintain an auditable vulnerability management workflow: triage, ownership, remediation SLAs, and exception/waiver documentation.
• Vulnerability triage & remediation enablement
• Provide actionable findings with clear reproduction steps and secure coding guidance.
• Partner with engineering teams to remediate issues in code, dependencies, container images, and Kubernetes configurations.
• Coordinate retesting and verify fixes (including targeted Burp validation for high-risk apps/APIs).
• Container/Kubernetes security (StackRox)
• Implement image scanning, runtime detections, admission controls, and Kubernetes policy enforcement.
• Integrate with registries and orchestration platforms; maintain cluster baselines and least‑privilege controls.
• Operationalize incident‑ready detections and response playbooks with SOC/IR teams.
• Reporting, compliance, and audit support
• Produce metrics and dashboards: vulnerability trends, time‑to‑remediate, pipeline pass rates, policy exceptions.
• Support Risk Management Framework (RMF) / Authority to Operate (ATO) evidence needs with scan outputs, control mappings, and procedures.
• Experience supporting Agile project management, with hands‑on Jira experience strongly preferred.
• Manage a team of at least one other AppSec professional.
• Required Qualifications
• Active Secret clearance required
• 5+ years in application security engineering and/or DevSecOps in regulated environments.
• Hands‑on administration and pipeline integration experience with Sonatype (Nexus IQ/Lifecycle), Fortify (SCA/SSC), StackRox/Red Hat ACS, and Burp Suite (Professional/Enterprise preferred).
• Strong CI/CD and automation skills; ability to implement repeatable integrations and policy gates.
• Working knowledge of:
• Linux administration, networking fundamentals, TLS/cert management, identity integration (SSO/LDAP)
• Common languages/build systems (e.g., Java/Maven/Gradle, .NET/NuGet, Node/npm, Python/pip)
• Preferred Qualifications

DoD/IC experience with RMF, STIGs, and vulnerability management processes.

• Familiarity with registries and orchestration: Harbor/Artifactory/ECR, Kubernetes/OpenShift, Helm.
• Experience integrating with SIEM/SOAR and ticketing (e.g., Splunk, ServiceNow, Jira).
• Relevant certifications (one or more): Security+, CISSP, CSSLP, GIAC, Kubernetes security certs.

EOE Statement We are an equal employment opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability status, protected veteran status or any other characteristic protected by law.

This position is currently accepting applications.