Security Engineer

Kforce Inc; San Diego (CA); Remote; USD 120,000 - 170,000; Full time

Job summary

Kforce Inc. is seeking a fully remote Security Engineer to collaborate with Engineering on identifying, validating, and remediating security risks across applications, cloud infrastructure, containers, and the SDLC.

The role blends application security, attacker mindset, and security automation, and requires reading source code with developers to build more secure systems. The ideal candidate has hands-on experience in application security, review of code for vulnerabilities, and strong

Qualifications

• Hands-on application security experience and ability to review source code.
• Proficiency with languages such as Python, Go, Java, C#, or C/C++.
• Experience with SAST/DAST/SCA and threat modeling.
• Strong collaboration with engineers and CI/CD processes.

Responsibilities

• Perform secure source code reviews for vulnerabilities in apps, APIs, and services.
• Build threat models for new and existing systems.
• Collaborate with engineers to remediate findings and drive closure.
• Review SAST/DAST/SCA, dependency, container, and SBOM findings and prioritize risk.
• Conduct hands-on security testing and reproduce vulnerabilities to confirm exploitability.
• Develop security tooling and automation using Python or Go.
• Work with Docker, CI/CD pipelines, Terraform, Ansible, or Salt.
• Support AWS cloud security and contribute to security architecture.
• Integrate security into engineering workflows to detect issues earlier.

Skills

Application security

Threat modeling

CI/CD security

Security automation

Code review

Tools

Snyk

Burp Suite

OWASP ZAP

Terraform

Job description

Responsibilities

Kforce has a client that is seeking a fully remote Security Engineer. Summary: This fully remote Security Engineer will work closely with Engineering to identify, validate, and remediate security risks across applications, cloud infrastructure, containers, and the software development lifecycle. This is not a traditional SOC or security operations role. The ideal candidate combines application security, an offensive security mindset, and security automation. You should be comfortable reading source code, thinking like an attacker, and working directly with developers to build more secure systems. Key Tasks:

• Perform secure source code reviews and identify vulnerabilities in applications, APIs, and services
• Build and maintain threat models for new and existing systems
• Partner directly with engineers to explain findings and drive remediation through closure
• Review SAST, DAST, SCA, dependency, container, and SBOM findings and prioritize meaningful risk
• Perform hands‑on security testing and reproduce vulnerabilities to determine whether they are exploitable
• Build proofs of concept and attack simulations in controlled Dev, QA, and Test environments
• Use AI and security tooling to improve attack simulation and security testing
• Build security utilities, scripts, integrations, and automation using Python, Go, or similar languages
• Work with Docker, CI/CD pipelines, Infrastructure as Code, and configuration management technologies such as Terraform, Ansible, or Salt
• Help identify and prevent configuration drift through repeatable automated controls
• Support application and cloud security within AWS
• Contribute to security architecture for mobile, data, cloud, and AI/ML initiatives
• Help integrate security into Engineering workflows so vulnerabilities are identified and addressed earlier in development

Requirements

• Approximately 5-7+ years of relevant software engineering, application security, product security, DevSecOps, penetration testing, or security-engineering experience
• Hands‑on Application Security experience
• Experience personally reviewing application source code for security vulnerabilities
• Ability to understand software written in languages such as Python, Go, Java, C#, C/C++, or similar
• Experience with SAST, DAST, SCA, vulnerability management, or dependency security
• Threat‑modeling and secure‑design experience
• Experience partnering directly with developers to remediate security vulnerabilities
• Understanding of CI/CD pipelines and where security controls should be incorporated
• Cloud‑security knowledge, ideally within AWS
• Ability to think from an attacker's perspective and validate whether a security weakness represents real exposure
• Strong communication and judgment when working directly with Engineering teams

Preferred

• Go/Golang
• Python
• Snyk
• Docker Scout or comparable container‑security tools
• Docker and Kubernetes
• Terraform
• Ansible or Salt
• Infrastructure as Code
• Configuration management and configuration‑drift detection
• Burp Suite
• OWASP ZAP
• Penetration testing/red teaming
• SAST, DAST and SCA
• SBOM/dependency security
• AWS security
• Security automation
• Policy as Code
• AI/LLM security testing
• Attack simulation
• OSCP, PenTest+, or comparable hands‑on offensive‑security experience

The pay range is the lowest to highest compensation we reasonably in good faith believe we would pay at posting for this role. We may ultimately pay more or less than this range. Employee pay is based on factors like relevant education, qualifications, certifications, experience, skills, seniority, location, performance, union contract and business needs. This range may be modified in the future.

We offer comprehensive benefits including medical/dental/vision insurance, HSA, FSA, 401(k), and life, disability & ADD insurance to eligible employees. Salaried personnel receive paid time off. Hourly employees are not eligible for paid time off unless required by law. Hourly employees on a Service Contract Act project are eligible for paid sick leave.

Note: Pay is not considered compensation until it is earned, vested and determinable. The amount and availability of any compensation remains in Kforce's sole discretion unless and until paid and may be modified in its discretion consistent with the law.

This job is not eligible for bonuses, incentives or commissions.

Kforce is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status, or disability status.