Cybersecurity Engineer – Application/Software Security

Cybersecurity Jobs; Arlington (VA); On-site; USD 140,000 - 170,000; Full time

Job summary

Data Systems Analysts, Inc. seeks a TS/SCI-cleared Cybersecurity Engineer focused on application and software security for onsite work supporting mission-critical DoD systems at NGIC in Arlington, VA.

You will drive secure development practices, perform code reviews, and validate remediations across applications, APIs, and back-end services. You will apply MITRE ATT&CK, conduct security testing, and generate RMF/ATO evidence while collaborating with engineers, ISSOs, and system owners to

Qualifications

• BS degree in Computer Science, Software Engineering, Computer Information Systems, Cybersecurity, or a related field.
• TS/SCI Clearance.
• 5+ years of experience in software development, application security, or secure software assessment.
• Hands-on development in Python, Java, C#, Go, or JavaScript.
• Knowledge of OWASP Top 10 and CWE; ability to remediate weaknesses.
• Ability to work with DoD systems and stakeholders.

Responsibilities

• Own software security responsibilities within a cyber engineering team, guiding secure applications, APIs, and back-end services.
• Conduct security testing of applications and validate remediations.
• Perform source code reviews aligned to secure coding standards to detect vulnerabilities.
• Implement, tune, and maintain security tooling (SAST, DAST, dependencies, containers).
• Assess open-source and commercial cyber tools for fit and risk.
• Collaborate with engineers, ISSOs, and ISSMs to define security requirements.
• Evaluate risks from major software changes and end-of-support components.
• Apply MITRE ATT&CK and threat modeling to prioritize findings.
• Document test results and RMF/ATO evidence.
• Communicate risks and fixes to engineers and leadership.

Skills

Secure development

Threat modeling

Code review

Stakeholder comms

Independent contributor

Education

BS degree in CS/SE/CIIS/Cybersecurity or related

Tools

Fortify

SonarQube

Checkmarx

Burp Suite

OWASP ZAP

GitLab

Jenkins

Job description

Data Systems Analysts, Inc. is seeking a TS/SCI-cleared Cybersecurity Engineer focused on application and software security for onsite work supporting mission-critical DoD systems. In this role at NGIC, you will help strengthen software security end to end, from secure development practices and vulnerability validation to evidence generation for RMF and ATO activities.

This position is located in Arlington, VA (onsite), with a salary range of USD 140,000 - 170,000 per yearly. The candidate should have 5 years of relevant experience and a BS degree in Computer Science, Software Engineering, Computer Information Systems, Cybersecurity, or a related field.

What you’ll do

• Own software security responsibilities within a cyber engineering team, providing technical guidance for securing applications, APIs, and back-end services.
• Conduct security testing of applications and validate that remediations resolve identified findings.
• Perform source code reviews aligned to secure coding standards to detect vulnerabilities, insecure design patterns, and exploitable weaknesses.
• Implement, tune, and maintain software security tooling including SAST, DAST, and dependency and container scanning, integrating results into development and release processes.
• Assess open-source and commercial cyber tools and code to determine fit, security risk, and what can be adapted to meet mission requirements.
• Collaborate with engineers, system administrators, architects, ISSOs, and ISSMs to define security requirements and confirm that tools and controls are sufficient.
• Evaluate risks introduced by major software changes, unpatched components, and software reaching end of support.
• Apply adversary techniques such as MITRE ATT&CK and threat modeling to prioritize findings based on real-world impact.
• Document independent test results, release risk, and technical evidence supporting RMF and ATO activities.
• Communicate software security risks, findings, and practical fixes to engineering teams, system owners, and leadership.

Qualifications

• BS degree in Computer Science, Software Engineering, Computer Information Systems, Cybersecurity, or a related field.
• TS/SCI Clearance.
• CompTIA Security+ (DoD 8140 compliant).
• Minimum 5 years of combined experience in software development, application security, penetration testing, or secure software assessment.
• Hands-on software development experience in at least one language such as Python, Java, C#, Go, or JavaScript, with familiarity across back-end services, APIs, and databases.
• Proven ability to find and validate software vulnerabilities through code review, security testing, or technical assessment.
• Working knowledge of OWASP Top 10 and CWE, including how weaknesses are exploited and how to remediate them.
• Ability to assess exploitability and impact, and clearly communicate practical fixes to engineers and compliance staff.
• Capability to work independently as the primary software security resource on a cybersecurity team.

Technologies you may work with

• Microsoft Copilot
• Languages: Python, Java, C#, Go, JavaScript
• Security & analysis: SAST, DAST, MITRE ATT&CK, OWASP Top 10, CWE
• Tools: Fortify, SonarQube, Checkmarx, Burp Suite, OWASP ZAP
• DevOps & repos: GitLab, Jenkins
• Data: Oracle, PostgreSQL
• Security documentation & governance: SBOMs, RMF, NIST SP 800-53, eMASS, DISA Application Security and Development STIG
• Cloud: AWS/GovCloud

Preferred qualifications

• Certifications such as GWAPT, OSCP, OSWE, CSSLP, PenTest+, CySA+, SecurityX/CASP+, CEH, CISSP, or other relevant certifications.
• Experience with SAST/DAST tools including Fortify, SonarQube, Checkmarx, Burp Suite, or OWASP ZAP.
• Penetration testing, red team, or web application testing experience.
• Experience integrating security checks into CI/CD pipelines using GitLab and Jenkins.
• Experience with SQL and relational databases (Oracle, PostgreSQL) and ETL workflows.
• Familiarity with containers, AWS/GovCloud, software supply chain security, or SBOMs.
• Familiarity with RMF, NIST SP 800-53, eMASS, and the DISA Application Security and Development STIG.
• Experience supporting DoD, U.S. Army, or Intelligence Community missions.