Remote Staff Application Security Architect & SDLC Leader

The AES Group; United States; Remote; USD 143,000 - 214,000; Full time

Job summary

The AES Group is seeking a Staff Application Security Engineer to build and advance a scalable, developer-focused security program for a defense technology client. This remote, full-time role focuses on embedding security into SDLC and strengthening software supply-chain security.

You will lead threat modeling, secure design reviews, risk-based vulnerability management, and collaboration with DevOps to secure CI/CD pipelines while enabling rapid and secure software releases.

Qualifications

• 7+ years of experience in application security, product security, DevSecOps, secure software engineering, or a related cybersecurity field.
• Proven experience designing, implementing, or maturing an application security or secure SDLC program across multiple engineering teams.
• Hands-on experience with SAST, DAST, SCA, secrets scanning, and dependency vulnerability management.
• Experience integrating security controls into source control, CI/CD, build, release, and deployment workflows.
• Strong knowledge of secure coding, API security, authentication, authorization, injection vulnerabilities, insecure deserialization, and business-logic vulnerabilities.
• Experience with threat modeling, security architecture reviews, and risk-based vulnerability management.
• Knowledge of SBOMs, software provenance, artifact signing, build integrity, release attestations, and open-source software governance.
• Familiarity with NIST SP 800-218 (SSDF), OWASP SAMM, SLSA, or comparable frameworks.
• Ability to review production code and scripts in at least one modern programming language.
• Strong communication skills and the ability to explain technical risks to developers, leadership, auditors, and nontechnical stakeholders.

Responsibilities

• Establish and continuously improve secure SDLC policies, standards, procedures, and control requirements.
• Assess application security maturity across development teams, source-code repositories, CI/CD pipelines, build systems, and release processes.
• Implement and optimize SAST, DAST, SCA, secrets detection, infrastructure-as-code scanning, and container security tools.
• Partner with developers to identify, prioritize, remediate, and validate application security vulnerabilities.
• Lead threat modeling, secure design reviews, architecture assessments, and security requirements definition.
• Develop risk-based vulnerability management processes, remediation SLAs, exception handling, and risk acceptance procedures.
• Strengthen software supply-chain security through SBOMs, dependency verification, build provenance, artifact signing, and release attestations.
• Establish open-source governance practices covering dependency vulnerabilities, license compliance, component inventories, and approval workflows.
• Collaborate with DevOps and platform engineering to secure CI/CD pipelines, build environments, package registries, secrets, and deployment processes.
• Support vulnerability disclosure, CVE triage, security advisories, and product-security incident response.
• Develop a security champions program and provide secure-coding guidance, developer training, and security enablement.
• Create metrics and reports covering security risks, remediation performance, control coverage, SDLC adoption, and program maturity.
• Support customer assurance, audits, and regulatory compliance activities.

Skills

Application security

DevSecOps

Secure SDLC

Threat modeling

Code review

Security architecture

Communication

Tools

Snyk

Checkmarx

Veracode

GitHub Advanced Security

GitLab Security

Semgrep

SonarQube

OWASP ZAP

Burp Suite

Mend

Black Duck

Job description

The AES Group is seeking a Staff Application Security Engineer to build and advance a scalable, developer-focused security program for a defense technology client. This remote, full-time role focuses on embedding security into SDLC and strengthening software supply-chain security.

You will lead threat modeling, secure design reviews, risk-based vulnerability management, and collaboration with DevOps to secure CI/CD pipelines while enabling rapid and secure software releases.