Security Engineer – Secure SDLC & Cloud Apps (Hybrid)

Commonwealth of VA Careers; Richmond (VA); Hybrid; USD 110,000 - 140,000; Full time

Benefits offered by this job

12 Paid State holidays

Comprehensive health benefits

Public Service Loan Forgiveness (PSLF)

Job summary

Virginia Tax is seeking an Information Systems Security Engineer to champion security across the Software Development Life Cycle. You will partner with application and engineering teams to identify and mitigate vulnerabilities, develop security plans, and enforce security standards.

The role combines hands-on security work with influencing engineering practices and supporting a security-first culture. The position is based at Main Street Centre in Richmond with a 3/2 hybrid schedule and requires

Qualifications

• Experience providing information security guidance and training.
• Knowledge and experience with application development and security architecture.
• Knowledge of secure coding standards and guidelines and ability to identify security flaws in source code.
• Knowledge of vulnerability remediation and patch management for applications.
• Experience with SAST, DAST, and IAST security testing tools (e.g., Accunetix, Veracode, Jenkins, Splunk, Rapid7, Tenable).
• Knowledge and experience with Web Application Firewalls (WAFs) and AWS Security Groups implementation strategies for application protection.
• Experience with and understanding of security information and event management (SIEM) systems (e.g., Splunk, Azure Sentinel, or IBM QRadar).
• Knowledge and experience with AWS services (e.g., Security Hub, GuardDuty, Security Groups, Inspector, Config, CloudWatch, S3 Buckets, IAM, CloudTrail, EC2, CodePipelines, KMS, and Secrets Manager).
• Knowledge and understanding of relevant security regulations and standards (e.g., NIST 800-53, IRS Pub 1075, PCI-DSS, OWASP Top10, MITRE ATT&CK, CIS Benchmarks, NIST CSF).
• Comprehensive knowledge of a System Security Plan (SSP) and experience in creating and maintaining an SSP.

Responsibilities

• Reviewing system architectures and developing/maintaining system security plans.
• Guiding teams on secure development practices and ensuring adherence to security policies and standards.
• Acting as a security advocate to empower application teams to design, deliver, and operate secure applications and environments.
• Influencing engineering practices to promote a security-first culture across the organization.

Skills

Information security guidance

Application development security

Secure coding standards

Vulnerability remediation

SIEM experience

AWS familiarity

Security policies & standards

Security lifecycle knowledge

Tools

SAST tools

DAST tools

IAST tools

WAFs

AWS Security Groups

Splunk

Azure Sentinel

IBM QRadar

Jenkins

Veracode

Accunetix

Rapid7

Tenable

CodePipeline

KMS

Secrets Manager

Job description

Virginia Tax is seeking an Information Systems Security Engineer to champion security across the Software Development Life Cycle. You will partner with application and engineering teams to identify and mitigate vulnerabilities, develop security plans, and enforce security standards.

The role combines hands-on security work with influencing engineering practices and supporting a security-first culture. The position is based at Main Street Centre in Richmond with a 3/2 hybrid schedule and requires