Remote Senior AppSec Engineer - Burp Suite & Linux

phia, LLC; Fairfax (VA); On-site; USD 140,000 - 180,000; Full time

Job summary

phia, LLC is seeking a Senior AppSec Engineer to join a small, highly technical team supporting a federal civilian client. This fully remote role focuses on Burp Suite Enterprise operations, custom extensions, and Linux automation to enable continuous security testing.

You will lead authentication, scan strategies, and tooling improvements, collaborating with development and identity teams, while ensuring rigorous remediation and true automation across the pipeline.

Qualifications

• 6+ years hands-on application security engineering experience.
• Expertise with Burp Suite Enterprise and Burp Suite Pro.
• Strong Linux/Unix administration from the command line.
• Proficiency writing custom Burp extensions and security automation scripts in Python and Java.
• Experience with Kubernetes, Docker, and YAML-driven infrastructure.
• Experience integrating security scanning into CI/CD pipelines using GitHub Actions and Dependabot.

Responsibilities

• Own day-to-day Burp Suite Enterprise DAST operations and health of Linux infrastructure.
• Configure authenticated scans and session handling for modern web apps and APIs.
• Diagnose and resolve Burp Enterprise scan failures end-to-end.
• Extend Burp Suite Professional with custom extensions to automate testing.
• Design scan authentication strategies including OAuth2, SSO, MFA, and machine-to-machine flows.

Skills

Burp Suite Enterprise

Linux/Unix

Automation scripting

Kubernetes/Docker

CI/CD (GitHub Actions)

Python

Tools

Burp Suite Professional

Montoya API

Ansible

Job description

phia, LLC is seeking a Senior AppSec Engineer to join a small, highly technical team supporting a federal civilian client. This fully remote role focuses on Burp Suite Enterprise operations, custom extensions, and Linux automation to enable continuous security testing.

You will lead authentication, scan strategies, and tooling improvements, collaborating with development and identity teams, while ensuring rigorous remediation and true automation across the pipeline.