Cybersecurity Engineer – Application/Software Security

Cybersecurity Jobs; Alexandria (VA); On-site; USD 140,000 - 170,000; Full time

Job summary

Data Systems Analysts, Inc. (DSA) is hiring a TS/SCI-cleared Cybersecurity Engineer focused on application and software security in a secure DoD environment at NGIC.

You will own software security, conduct security testing, and perform code reviews to identify vulnerabilities and validate fixes. The role emphasizes implementing and maintaining security tooling (SAST, DAST, container scanning), integrating them into development and release processes, and evaluating tools to meet mission

Qualifications

• BS degree in Computer Science, Software Engineering, or related field; experience may substitute degree.
• TS/SCI clearance required.
• 5+ years in software development, application security, or secure software assessment.
• Hands-on development in Python, Java, C#, Go, or JavaScript with backend services/APIs/databases.
• Familiarity with OWASP Top 10 and CWE; ability to assess exploitability and impact.

Responsibilities

• Own software security within the cyber engineering team for applications, APIs, and back-end services.
• Conduct security testing of applications and validate fixes.
• Perform source code reviews against secure coding standards.
• Implement and maintain security tooling (SAST/DAST, dependency scanning, container scanning) and integrate into development/release processes.
• Evaluate open-source and commercial cyber tools for mission requirements.
• Partner with engineers, system admins, architects, ISSOs/ISSMs to define security requirements.
• Assess risk from major software changes, unpatched components, and end of support.
• Apply adversary techniques (MITRE ATT&CK) and perform threat modeling.
• Document test results, release risk, and RMF/ATO supporting evidence.
• Communicate software risks and fixes to technical teams and leadership.

Skills

Software security

Security testing

Code reviews

Threat modeling

RMF/ATO

Education

BS degree in Computer Science or related field

Tools

Fortify

SonarQube

Checkmarx

Burp Suite

OWASP ZAP

GitLab

Jenkins

CI/CD pipelines

AWS/GovCloud

Job description

Data Systems Analysts, Inc. (DSA) is hiring a TS/SCI-cleared Cybersecurity Engineer focused on application and software security in a secure DoD environment at NGIC.

Responsibilities

• Own software security within the cyber engineering team by providing technical guidance to secure applications, APIs, and back-end services.
• Conduct security testing of applications and validate that fixes address identified findings.
• Perform source code reviews against secure coding standards to identify vulnerabilities, insecure design, and exploitable weaknesses.
• Implement, tune, and maintain software security tooling such as SAST, DAST, dependency scanning, and container scanning, and integrate tooling into development and release processes.
• Evaluate open-source and commercial cyber tools and source code to determine security risk, fit, and what can be adapted for mission requirements.
• Partner with engineers, system admins, architects, ISSOs, and ISSMs to define security requirements and verify tools and controls are sufficient.
• Assess risk tied to major software changes, unpatched components, and software reaching end of support.
• Apply adversary techniques (for example, MITRE ATT&CK) and perform threat modeling to prioritize findings based on real-world impact.
• Document independent test results, release risk, and technical evidence supporting RMF and ATO activities.
• Communicate software risks, findings, and practical fixes to technical teams, system owners, and leadership.

Requirements

• BS degree in Computer Science, Software Engineering, Computer Information Systems, Cybersecurity, or related field.
• Experience may be substituted for degree.
• TS/SCI clearance.
• CompTIA Security+ (DoD 8140 compliant).
• Minimum 5 years combined experience in software development, application security, penetration testing, or secure software assessment.
• Hands-on software development experience in at least one language: Python, Java, C#, Go, or JavaScript, with understanding of back-end services, APIs, and databases.
• Demonstrated ability to find and validate software vulnerabilities via code review, security testing, or technical assessment.
• Working knowledge of OWASP Top 10 and CWE, including exploitation and remediation approaches.
• Ability to assess exploitability and impact and communicate clear, practical fixes to engineers and compliance staff.
• Ability to work independently as the primary software security resource on a cybersecurity team.

Technologies

• Microsoft Copilot
• Languages: Python, Java, C#, Go, JavaScript
• Security testing and scanning: SAST, DAST, dependency scanning, container scanning
• Standards and frameworks: MITRE ATT&CK, OWASP Top 10, CWE
• Tools: Fortify, SonarQube, Checkmarx, Burp Suite, OWASP ZAP
• Databases and querying: SQL, Oracle, PostgreSQL
• DevOps: GitLab, Jenkins, CI/CD pipelines
• Cloud: AWS/GovCloud
• Supply chain and compliance: SBOMs, RMF, NIST SP 800-53, eMASS, DISA Application Security and Development STIG, ATO

Preferred Experience / Qualifications

• Certifications such as GWAPT, OSCP, OSWE, CSSLP, PenTest+, CySA+, SecurityX/CASP+, CEH, CISSP, or other relevant certifications.
• Experience with SAST/DAST tools including Fortify, SonarQube, Checkmarx, Burp Suite, or OWASP ZAP.
• Penetration testing, red team, or web application testing experience.
• Experience integrating security checks into CI/CD pipelines (GitLab, Jenkins).
• Experience with SQL, relational databases (Oracle, PostgreSQL), and ETL workflows.
• Familiarity with containers, AWS/GovCloud, software supply chain security, or SBOMs.
• Familiarity with RMF, NIST SP 800-53, eMASS, and the DISA Application Security and Development STIG.
• Experience supporting DoD, U.S. Army, or Intelligence Community missions.

Job Details

• Location: Alexandria, VA (onsite)
• Clearance: TS/SCI
• Estimated Salary: USD 140,000 - 170,000 per year
• Education: BS degree in a relevant field

Role summary: Secure mission-critical software in a secure DoD environment at NGIC by owning application security testing, code review, vulnerability validation, and maintaining security tooling integrated into development and release processes.